STIGhub
STIGs
RMF Controls
Compare
← SC-5 — Denial-of-Service Protection
CCI-002385
Definition
Protect against or limit the effects of organization-defined types of denial-of-service events.
Parent Control
SC-5
Denial-of-Service Protection
System and Communications Protection
Linked STIG Checks (200)
V-237049
CAT I
The A10 Networks ADC must protect against TCP and UDP Denial of Service (DoS) attacks by employing Source-IP based connection-rate limiting.
A10 Networks ADC ALG Security Technical Implementation Guide
V-237050
CAT II
The A10 Networks ADC must implement load balancing to limit the effects of known and unknown types of Denial of Service (DoS) attacks.
A10 Networks ADC ALG Security Technical Implementation Guide
V-237051
CAT II
The A10 Networks ADC must enable DDoS filters.
A10 Networks ADC ALG Security Technical Implementation Guide
V-237062
CAT I
The A10 Networks ADC must protect against ICMP-based Denial of Service (DoS) attacks by employing ICMP Rate Limiting.
A10 Networks ADC ALG Security Technical Implementation Guide
V-279040
CAT II
ColdFusion must configure WebSocket Service.
Adobe ColdFusion Security Technical Implementation Guide
V-279050
CAT II
ColdFusion must be configured with secure and approved server settings to enforce application hardening, input validation, error handling, and protection against common web vulnerabilities.
Adobe ColdFusion Security Technical Implementation Guide
V-279060
CAT II
ColdFusion must transmit only encrypted representations of passwords to the mail server.
Adobe ColdFusion Security Technical Implementation Guide
V-279069
CAT II
ColdFusion systems must provide clustering.
Adobe ColdFusion Security Technical Implementation Guide
V-279073
CAT II
ColdFusion must set a maximum session timeout value.
Adobe ColdFusion Security Technical Implementation Guide
V-279079
CAT II
ColdFusion must set Request Tuning configurations.
Adobe ColdFusion Security Technical Implementation Guide
V-279080
CAT II
ColdFusion must limit the maximum number of threads available for CFTHREAD.
Adobe ColdFusion Security Technical Implementation Guide
V-279081
CAT II
ColdFusion must limit the maximum number of Web Service requests.
Adobe ColdFusion Security Technical Implementation Guide
V-279082
CAT II
ColdFusion must limit the maximum number of ColdFusion Component (CFC) function requests.
Adobe ColdFusion Security Technical Implementation Guide
V-279083
CAT II
ColdFusion must configure Data Sources to limit SQL command and configure timeout.
Adobe ColdFusion Security Technical Implementation Guide
V-279084
CAT II
ColdFusion must not store user information in the server registry.
Adobe ColdFusion Security Technical Implementation Guide
V-279085
CAT II
ColdFusion must limit the in-memory size of the virtual file system.
Adobe ColdFusion Security Technical Implementation Guide
V-279086
CAT II
ColdFusion must limit the default maximum thread count for parallel functions.
Adobe ColdFusion Security Technical Implementation Guide
V-279087
CAT II
ColdFusion must limit the maximum post data size.
Adobe ColdFusion Security Technical Implementation Guide
V-279088
CAT II
ColdFusion must limit the request throttle memory.
Adobe ColdFusion Security Technical Implementation Guide
V-279089
CAT II
ColdFusion must set an organization defined maximum number of cached templates.
Adobe ColdFusion Security Technical Implementation Guide
V-279090
CAT II
ColdFusion must set an organization defined maximum JVM heap size.
Adobe ColdFusion Security Technical Implementation Guide
V-279091
CAT II
ColdFusion must set a nonzero timeout for web services.
Adobe ColdFusion Security Technical Implementation Guide
V-76421
CAT II
Kona Site Defender providing content filtering must protect against known and unknown types of denial-of-service (DoS) attacks by employing rate-based attack prevention behavior analysis.
Akamai KSD Service Impact Level 2 ALG Security Technical Implementation Guide
V-76423
CAT II
Kona Site Defender providing content filtering must protect against known types of denial-of-service (DoS) attacks by employing signatures.
Akamai KSD Service Impact Level 2 ALG Security Technical Implementation Guide
V-274183
CAT II
Amazon Linux 2023 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures are configured on impacted network interfaces.
Amazon Linux 2023 Security Technical Implementation Guide
V-268158
CAT II
NixOS must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring the operating system is implementing rate-limiting measures on impacted network interfaces.
Anduril NixOS Security Technical Implementation Guide
V-214255
CAT II
The Apache web server must be tuned to handle the operational requirements of the hosted application.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214267
CAT II
The Apache web server must be protected from being stopped by a non-privileged user.
Apache Server 2.4 UNIX Server Security Technical Implementation Guide
V-214338
CAT II
The Apache web server must restrict the ability of users to launch denial-of-service (DoS) attacks against other information systems or networks.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-214353
CAT II
The Apache web server must be protected from being stopped by a non-privileged user.
Apache Server 2.4 Windows Server Security Technical Implementation Guide
V-222995
CAT II
The application server, when categorized as a high availability system within RMF, must be in a high-availability (HA) cluster.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-222996
CAT II
Tomcat server must be patched for security vulnerabilities.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-205004
CAT II
The ALG providing content filtering must protect against known and unknown types of Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis.
Application Layer Gateway Security Requirements Guide
V-205005
CAT II
The ALG must implement load balancing to limit the effects of known and unknown types of Denial of Service (DoS) attacks.
Application Layer Gateway Security Requirements Guide
V-205006
CAT II
The ALG providing content filtering must protect against known types of Denial of Service (DoS) attacks by employing signatures.
Application Layer Gateway Security Requirements Guide
V-205007
CAT II
The ALG providing content filtering must protect against or limit the effects of known and unknown types of Denial of Service (DoS) attacks by employing pattern recognition pre-processors.
Application Layer Gateway Security Requirements Guide
V-274707
CAT II
The API must use a gateway.
Application Programming Interface (API) Security Requirements Guide
V-222593
CAT II
XML-based applications must mitigate DoS attacks by using XML filters, parser options, or gateways.
Application Security and Development Security Technical Implementation Guide
V-204814
CAT II
The application server, when a MAC I system, must be in a high-availability (HA) cluster.
Application Server Security Requirements Guide
V-204815
CAT II
The application server must protect against or limit the effects of all types of Denial of Service (DoS) attacks by employing organization-defined security safeguards.
Application Server Security Requirements Guide
V-217525
CAT II
The Arista Multilayer Switch must ensure all Exterior Border Gateway Protocol (eBGP) routers are configured to use Generalized TTL Security Mechanism (GTSM) or are configured to meet RFC3682.
Arista MLS DCS-7000 Series RTR Security Technical Implementation Guide
V-255970
CAT III
The Arista MLS switch must have Root Guard enabled on all switch ports connecting to access layer switches and hosts.
Arista MLS EOS 4.2x L2S Security Technical Implementation Guide
V-255971
CAT II
The Arista MLS layer 2 switch must have BPDU Guard enabled on all switch ports connecting to access layer switches and hosts.
Arista MLS EOS 4.2x L2S Security Technical Implementation Guide
V-255972
CAT II
The Arista MLS switch must have STP Loop Guard enabled on all nondesignated STP switch ports.
Arista MLS EOS 4.2x L2S Security Technical Implementation Guide
V-255973
CAT II
The Arista MLS layer 2 switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources.
Arista MLS EOS 4.2x L2S Security Technical Implementation Guide
V-255974
CAT II
The Arista MLS layer 2 switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports.
Arista MLS EOS 4.2x L2S Security Technical Implementation Guide
V-255975
CAT II
The Arista MLS layer 2 switch must have Dynamic Address Resolution Protocol (ARP) Inspection (DAI) enabled on all user VLANs.
Arista MLS EOS 4.2x L2S Security Technical Implementation Guide
V-256029
CAT II
The Arista router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.
Arista MLS EOS 4.2x Router Security Technical Implementation Guide
V-256030
CAT II
The Arista router must be configured to have gratuitous ARP disabled on all external interfaces.
Arista MLS EOS 4.2x Router Security Technical Implementation Guide
V-256031
CAT III
The Arista router must be configured to have IP directed broadcast disabled on all interfaces.
Arista MLS EOS 4.2x Router Security Technical Implementation Guide
V-256032
CAT II
The Arista router must be configured to have Internet Control Message Protocol (ICMP) unreachable notifications disabled on all external interfaces.
Arista MLS EOS 4.2x Router Security Technical Implementation Guide
V-256033
CAT II
The Arista router must be configured to have Internet Control Message Protocol (ICMP) mask replies disabled on all external interfaces.
Arista MLS EOS 4.2x Router Security Technical Implementation Guide
V-256034
CAT II
The Arista router must be configured to have Internet Control Message Protocol (ICMP) redirects disabled on all external interfaces.
Arista MLS EOS 4.2x Router Security Technical Implementation Guide
V-256035
CAT II
The Arista BGP router must be configured to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.
Arista MLS EOS 4.2x Router Security Technical Implementation Guide
V-256036
CAT III
The Arista BGP router must be configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer.
Arista MLS EOS 4.2x Router Security Technical Implementation Guide
V-256037
CAT III
The multicast Rendezvous Point (RP) Arista router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries.
Arista MLS EOS 4.2x Router Security Technical Implementation Guide
V-256038
CAT II
The Arista multicast Designated Router (DR) must be configured to increase the shortest-path tree (SPT) threshold or set it to infinity to minimalize source-group (S, G) state within the multicast topology where Any Source Multicast (ASM) is deployed.
Arista MLS EOS 4.2x Router Security Technical Implementation Guide
V-256039
CAT III
The Arista BGP router must be configured to enable the Generalized TTL Security Mechanism (GTSM).
Arista MLS EOS 4.2x Router Security Technical Implementation Guide
V-255969
CAT II
The Arista MLS layer 2 switch must be configured for Storm Control to limit the effects of packet flooding types of denial-of-service (DoS) attacks.
Arista MLS EOS 4.X L2S Security Technical Implementation Guide
V-255970
CAT III
The Arista MLS switch must have Root Guard enabled on all switch ports connecting to access layer switches and hosts.
Arista MLS EOS 4.X L2S Security Technical Implementation Guide
V-255971
CAT II
The Arista MLS layer 2 switch must have BPDU Guard enabled on all switch ports connecting to access layer switches and hosts.
Arista MLS EOS 4.X L2S Security Technical Implementation Guide
V-255972
CAT II
The Arista MLS switch must have STP Loop Guard enabled on all nondesignated STP switch ports.
Arista MLS EOS 4.X L2S Security Technical Implementation Guide
V-255973
CAT II
The Arista MLS layer 2 switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources.
Arista MLS EOS 4.X L2S Security Technical Implementation Guide
V-255974
CAT II
The Arista MLS layer 2 switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports.
Arista MLS EOS 4.X L2S Security Technical Implementation Guide
V-255975
CAT II
The Arista MLS layer 2 switch must have Dynamic Address Resolution Protocol (ARP) Inspection (DAI) enabled on all user VLANs.
Arista MLS EOS 4.X L2S Security Technical Implementation Guide
V-256029
CAT II
The Arista router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.
Arista MLS EOS 4.X Router Security Technical Implementation Guide
V-256030
CAT II
The Arista router must be configured to have gratuitous ARP disabled on all external interfaces.
Arista MLS EOS 4.X Router Security Technical Implementation Guide
V-256031
CAT III
The Arista router must be configured to have IP directed broadcast disabled on all interfaces.
Arista MLS EOS 4.X Router Security Technical Implementation Guide
V-256032
CAT II
The Arista router must be configured to have Internet Control Message Protocol (ICMP) unreachable notifications disabled on all external interfaces.
Arista MLS EOS 4.X Router Security Technical Implementation Guide
V-256033
CAT II
The Arista router must be configured to have Internet Control Message Protocol (ICMP) mask replies disabled on all external interfaces.
Arista MLS EOS 4.X Router Security Technical Implementation Guide
V-256034
CAT II
The Arista router must be configured to have Internet Control Message Protocol (ICMP) redirects disabled on all external interfaces.
Arista MLS EOS 4.X Router Security Technical Implementation Guide
V-256035
CAT II
The Arista BGP router must be configured to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.
Arista MLS EOS 4.X Router Security Technical Implementation Guide
V-256036
CAT III
The Arista BGP router must be configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer.
Arista MLS EOS 4.X Router Security Technical Implementation Guide
V-256037
CAT III
The multicast Rendezvous Point (RP) Arista router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries.
Arista MLS EOS 4.X Router Security Technical Implementation Guide
V-256038
CAT II
The Arista multicast Designated Router (DR) must be configured to increase the shortest-path tree (SPT) threshold or set it to infinity to minimalize source-group (S, G) state within the multicast topology where Any Source Multicast (ASM) is deployed.
Arista MLS EOS 4.X Router Security Technical Implementation Guide
V-256039
CAT III
The Arista BGP router must be configured to enable the Generalized TTL Security Mechanism (GTSM).
Arista MLS EOS 4.X Router Security Technical Implementation Guide
V-276001
CAT II
Ax-OS must limit the number of concurrent sessions to 10 for all accounts and/or account types.
Axonius Federal Systems Ax-OS Security Technical Implementation Guide
V-237399
CAT II
The CA API Gateway providing content filtering must protect against known and unknown types of Denial of Service (DoS) attacks by employing rate-based attack prevention behavior analysis.
CA API Gateway ALG Security Technical Implementation Guide
V-237400
CAT II
The CA API Gateway must implement load balancing to limit the effects of known and unknown types of Denial of Service (DoS) attacks.
CA API Gateway ALG Security Technical Implementation Guide
V-255521
CAT II
The CA API Gateway must protect against or limit the effects of all known types of Denial of Service (DoS) attacks on the CA API Gateway management network by employing organization-defined security safeguards.
CA API Gateway NDM Security Technical Implementation Guide
V-219340
CAT II
The Ubuntu operating system must configure the uncomplicated firewall to rate-limit impacted network interfaces.
Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide
V-238367
CAT II
The Ubuntu operating system must configure the uncomplicated firewall to rate-limit impacted network interfaces.
Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide
V-260517
CAT II
Ubuntu 22.04 LTS must configure the Uncomplicated Firewall (ufw) to rate-limit impacted network interfaces.
Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide
V-270754
CAT II
Ubuntu 24.04 LTS must configure the uncomplicated firewall to rate-limit impacted network interfaces.
Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide
V-272033
CAT II
The Cisco ACI layer 2 switch must have Unknown Unicast Flood Blocking (UUFB) set to "Hardware Proxy".
Cisco ACI Layer 2 Switch Security Technical Implementation Guide
V-272037
CAT II
The Cisco ACI layer 2 switch must enable port security.
Cisco ACI Layer 2 Switch Security Technical Implementation Guide
V-272045
CAT II
The Cisco ACI layer 2 switch must employ a first-hop-security (FHS) policy to protect against denial-of-service (DoS) attacks.
Cisco ACI Layer 2 Switch Security Technical Implementation Guide
V-272086
CAT II
The Cisco ACI must be configured to have gratuitous ARP (GARP) disabled on all external interfaces.
Cisco ACI Router Security Technical Implementation Guide
V-272087
CAT II
The Cisco ACI must be configured to have Internet Control Message Protocol (ICMP) mask replies disabled on all external interfaces.
Cisco ACI Router Security Technical Implementation Guide
V-272088
CAT II
The BGP Cisco ACI must be configured to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.
Cisco ACI Router Security Technical Implementation Guide
V-272089
CAT III
The BGP Cisco ACI must be configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer.
Cisco ACI Router Security Technical Implementation Guide
V-272091
CAT II
The multicast rendezvous point (RP) must be configured to rate limit the number of Protocol Independent Multicast (PIM) Register messages.
Cisco ACI Router Security Technical Implementation Guide
V-272092
CAT II
The Cisco ACI must be configured to limit the mroute states created by Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) reports on a Cisco APIC Bridge Domain (BD) or interface.
Cisco ACI Router Security Technical Implementation Guide
V-272094
CAT III
Cisco ACI must be configured so the BGP neighbor is directly connected and will not connect a BGP session to a directly connected neighbor device's loopback address.
Cisco ACI Router Security Technical Implementation Guide
V-272104
CAT II
The Cisco ACI must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.
Cisco ACI Router Security Technical Implementation Guide
V-239864
CAT I
The Cisco ASA must be configured to implement scanning threat detection.
Cisco ASA Firewall Security Technical Implementation Guide
V-239932
CAT II
The Cisco ASA must be configured to protect against known types of denial-of-service (DoS) attacks by enabling the Threat Detection feature.
Cisco ASA NDM Security Technical Implementation Guide
V-215701
CAT II
The Cisco router must be configured to protect against known types of denial-of-service (DoS) attacks by employing organization-defined security safeguards.
Cisco IOS Router NDM Security Technical Implementation Guide
V-216559
CAT II
The Cisco router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.
Cisco IOS Router RTR Security Technical Implementation Guide
V-216560
CAT I
The Cisco router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.
Cisco IOS Router RTR Security Technical Implementation Guide
V-216563
CAT II
The Cisco router must be configured to have Gratuitous ARP disabled on all external interfaces.
Cisco IOS Router RTR Security Technical Implementation Guide
V-216564
CAT III
The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.
Cisco IOS Router RTR Security Technical Implementation Guide
V-216565
CAT II
The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.
Cisco IOS Router RTR Security Technical Implementation Guide
V-216566
CAT II
The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.
Cisco IOS Router RTR Security Technical Implementation Guide
V-216567
CAT II
The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.
Cisco IOS Router RTR Security Technical Implementation Guide
V-216604
CAT II
The Cisco BGP router must be configured to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.
Cisco IOS Router RTR Security Technical Implementation Guide
V-216605
CAT III
The Cisco BGP router must be configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer.
Cisco IOS Router RTR Security Technical Implementation Guide
V-216625
CAT III
The Cisco multicast Rendezvous Point (RP) router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries.
Cisco IOS Router RTR Security Technical Implementation Guide
V-216628
CAT II
The Cisco multicast Rendezvous Point (RP) must be configured to rate limit the number of Protocol Independent Multicast (PIM) Register messages.
Cisco IOS Router RTR Security Technical Implementation Guide
V-216631
CAT II
The Cisco multicast Designated Router (DR) must be configured to limit the number of mroute states resulting from Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Host Membership Reports.
Cisco IOS Router RTR Security Technical Implementation Guide
V-216632
CAT II
The Cisco multicast Designated Router (DR) must be configured to set the shortest-path tree (SPT) threshold to infinity to minimalize source-group (S, G) state within the multicast topology where Any Source Multicast (ASM) is deployed.
Cisco IOS Router RTR Security Technical Implementation Guide
V-216991
CAT III
The Cisco BGP router must be configured to enable the Generalized TTL Security Mechanism (GTSM).
Cisco IOS Router RTR Security Technical Implementation Guide
V-220629
CAT III
The Cisco switch must have Root Guard enabled on all switch ports connecting to access layer switches.
Cisco IOS Switch L2S Security Technical Implementation Guide
V-220630
CAT II
The Cisco switch must have Bridge Protocol Data Unit (BPDU) Guard enabled on all user-facing or untrusted access switch ports.
Cisco IOS Switch L2S Security Technical Implementation Guide
V-220631
CAT II
The Cisco switch must have Spanning Tree Protocol (STP) Loop Guard enabled.
Cisco IOS Switch L2S Security Technical Implementation Guide
V-220632
CAT II
The Cisco switch must have Unknown Unicast Flood Blocking (UUFB) enabled.
Cisco IOS Switch L2S Security Technical Implementation Guide
V-220633
CAT II
The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources.
Cisco IOS Switch L2S Security Technical Implementation Guide
V-220634
CAT II
The Cisco switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports.
Cisco IOS Switch L2S Security Technical Implementation Guide
V-220635
CAT II
The Cisco switch must have Dynamic Address Resolution Protocol (ARP) Inspection (DAI) enabled on all user VLANs.
Cisco IOS Switch L2S Security Technical Implementation Guide
V-220609
CAT II
The Cisco switch must be configured to protect against known types of denial-of-service (DoS) attacks by employing organization-defined security safeguards.
Cisco IOS Switch NDM Security Technical Implementation Guide
V-220427
CAT II
The Cisco switch must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.
Cisco IOS Switch RTR Security Technical Implementation Guide
V-220428
CAT I
The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.
Cisco IOS Switch RTR Security Technical Implementation Guide
V-220431
CAT II
The Cisco switch must be configured to have gratuitous ARP disabled on all external interfaces.
Cisco IOS Switch RTR Security Technical Implementation Guide
V-220432
CAT III
The Cisco switch must be configured to have IP directed broadcast disabled on all interfaces.
Cisco IOS Switch RTR Security Technical Implementation Guide
V-220433
CAT II
The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.
Cisco IOS Switch RTR Security Technical Implementation Guide
V-220434
CAT II
The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.
Cisco IOS Switch RTR Security Technical Implementation Guide
V-220435
CAT II
The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.
Cisco IOS Switch RTR Security Technical Implementation Guide
V-220466
CAT II
The Cisco multicast Designated switch (DR) must be configured to limit the number of mroute states resulting from Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Host Membership Reports.
Cisco IOS Switch RTR Security Technical Implementation Guide
V-220467
CAT II
The Cisco multicast Designated switch (DR) must be configured to set the shortest-path tree (SPT) threshold to infinity to minimalize source-group (S, G) state within the multicast topology where Any Source Multicast (ASM) is deployed.
Cisco IOS Switch RTR Security Technical Implementation Guide
V-216649
CAT II
The Cisco router must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-216650
CAT I
The Cisco router must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-216653
CAT II
The Cisco router must be configured to have Gratuitous ARP disabled on all external interfaces.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-216654
CAT III
The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-216655
CAT II
The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-216656
CAT II
The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-216657
CAT II
The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-216694
CAT II
The Cisco BGP router must be configured to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-216695
CAT III
The Cisco BGP router must be configured to limit the prefix size on any inbound route advertisement to /24, or the least significant prefixes issued to the customer.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-216709
CAT III
The Cisco PE router must be configured to implement Internet Group Management Protocol (IGMP) or Multicast Listener Discovery (MLD) snooping for each Virtual Private LAN Services (VPLS) bridge domain.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-216720
CAT III
The Cisco multicast Rendezvous Point (RP) router must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-216723
CAT II
The Cisco multicast Rendezvous Point (RP) must be configured to rate limit the number of Protocol Independent Multicast (PIM) Register messages.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-216726
CAT II
The Cisco multicast Designated Router (DR) must be configured to limit the number of mroute states resulting from Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Host Membership Reports.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-216727
CAT II
The Cisco multicast Designated Router (DR) must be configured to set the shortest-path tree (SPT) threshold to infinity to minimalize source-group (S, G) state within the multicast topology where Any Source Multicast (ASM) is deployed.
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-216999
CAT III
The Cisco BGP router must be configured to enable the Generalized TTL Security Mechanism (GTSM).
Cisco IOS XE Router RTR Security Technical Implementation Guide
V-220655
CAT III
The Cisco switch must have Root Guard enabled on all switch ports connecting to access layer switches.
Cisco IOS XE Switch L2S Security Technical Implementation Guide
V-220656
CAT II
The Cisco switch must have BPDU Guard enabled on all user-facing or untrusted access switch ports.
Cisco IOS XE Switch L2S Security Technical Implementation Guide
V-220657
CAT II
The Cisco switch must have STP Loop Guard enabled.
Cisco IOS XE Switch L2S Security Technical Implementation Guide
V-220658
CAT II
The Cisco switch must have Unknown Unicast Flood Blocking (UUFB) enabled.
Cisco IOS XE Switch L2S Security Technical Implementation Guide
V-220659
CAT II
The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources.
Cisco IOS XE Switch L2S Security Technical Implementation Guide
V-220660
CAT II
The Cisco switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports.
Cisco IOS XE Switch L2S Security Technical Implementation Guide
V-220661
CAT II
The Cisco switch must have Dynamic Address Resolution Protocol (ARP) Inspection (DAI) enabled on all user VLANs.
Cisco IOS XE Switch L2S Security Technical Implementation Guide
V-220994
CAT II
The Cisco switch must not be configured to have any zero-touch deployment feature enabled when connected to an operational network.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-220995
CAT I
The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-220998
CAT II
The Cisco switch must be configured to have Gratuitous ARP disabled on all external interfaces.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-220999
CAT III
The Cisco switch must be configured to have IP directed broadcast disabled on all interfaces.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-221000
CAT II
The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-221001
CAT II
The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-221002
CAT II
The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-221021
CAT III
The Cisco BGP switch must be configured to enable the Generalized TTL Security Mechanism (GTSM).
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-221030
CAT II
The Cisco BGP switch must be configured to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-221031
CAT III
The Cisco BGP switch must be configured to limit the prefix size on any inbound route advertisement to /24, or the least significant prefixes issued to the customer.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-221045
CAT III
The Cisco PE switch must be configured to implement Internet Group Management Protocol (IGMP) or Multicast Listener Discovery (MLD) snooping for each Virtual Private LAN Services (VPLS) bridge domain.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-221056
CAT III
The Cisco multicast Rendezvous Point (RP) switch must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-221059
CAT II
The Cisco multicast Rendezvous Point (RP) must be configured to rate limit the number of Protocol Independent Multicast (PIM) Register messages.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-221062
CAT II
The Cisco multicast Designated switch (DR) must be configured to limit the number of mroute states resulting from Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Host Membership Reports.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-221063
CAT II
The Cisco multicast Designated switch (DR) must be configured to set the shortest-path tree (SPT) threshold to infinity to minimalize source-group (S, G) state within the multicast topology where Any Source Multicast (ASM) is deployed.
Cisco IOS XE Switch RTR Security Technical Implementation Guide
V-216745
CAT III
The Cisco router must be configured to have IP directed broadcast disabled on all interfaces.
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-216746
CAT II
The Cisco router must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-216747
CAT II
The Cisco router must be configured to have Internet Control Message Protocol (ICMP) mask reply messages disabled on all external interfaces.
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-216748
CAT II
The Cisco router must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-216784
CAT II
The Cisco BGP router must be configured to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-216785
CAT III
The Cisco BGP router must be configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer.
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-216799
CAT III
The Cisco PE router must be configured to implement Internet Group Management Protocol (IGMP) or Multicast Listener Discovery (MLD) snooping for each Virtual Private LAN Services (VPLS) bridge domain.
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-216810
CAT III
The Cisco multicast Rendezvous Point (RP) router must be configured to filter Protocol Independent Multicast (PIM) Join messages received from the Designated Router (DR) for any undesirable multicast groups.
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-216813
CAT II
The Cisco multicast Rendezvous Point (RP) must be configured to rate limit the number of Protocol Independent Multicast (PIM) Register messages.
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-216816
CAT II
The Cisco multicast Designated Router (DR) must be configured to limit the number of mroute states resulting from Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Host Membership Reports.
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-216817
CAT II
The Cisco multicast Designated Router (DR) must be configured to set the shortest-path tree (SPT) threshold to infinity to minimalize source-group (S, G) state within the multicast topology where Any Source Multicast (ASM) is deployed.
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-217007
CAT III
The Cisco BGP router must be configured to enable the Generalized TTL Security Mechanism (GTSM).
Cisco IOS XR Router RTR Security Technical Implementation Guide
V-242660
CAT II
The Cisco ISE must configure the control plane to protect against or limit the effects of common types of Denial of Service (DoS) attacks on the device itself by configuring applicable system options and internet-options.
Cisco ISE NDM Security Technical Implementation Guide
V-220680
CAT III
The Cisco switch must have Root Guard enabled on all switch ports connecting to access layer switches and hosts.
Cisco NX OS Switch L2S Security Technical Implementation Guide
V-220681
CAT II
The Cisco switch must have BPDU Guard enabled on all user-facing or untrusted access switch ports.
Cisco NX OS Switch L2S Security Technical Implementation Guide
V-220682
CAT II
The Cisco switch must have STP Loop Guard enabled.
Cisco NX OS Switch L2S Security Technical Implementation Guide
V-220683
CAT II
The Cisco switch must have Unknown Unicast Flood Blocking (UUFB) enabled.
Cisco NX OS Switch L2S Security Technical Implementation Guide
V-220684
CAT II
The Cisco switch must have DHCP snooping for all user VLANs to validate DHCP messages from untrusted sources.
Cisco NX OS Switch L2S Security Technical Implementation Guide
V-220685
CAT II
The Cisco switch must have IP Source Guard enabled on all user-facing or untrusted access switch ports.
Cisco NX OS Switch L2S Security Technical Implementation Guide
V-220686
CAT II
The Cisco switch must have Dynamic Address Resolution Protocol (ARP) Inspection (DAI) enabled on all user VLANs.
Cisco NX OS Switch L2S Security Technical Implementation Guide
V-260464
CAT II
The Cisco switch must be configured to protect against known types of denial-of-service (DoS) attacks by employing organization-defined security safeguards.
Cisco NX OS Switch NDM Security Technical Implementation Guide
V-221079
CAT II
The Cisco switch must be configured to protect against or limit the effects of denial-of-service (DoS) attacks by employing control plane protection.
Cisco NX OS Switch RTR Security Technical Implementation Guide
V-221082
CAT II
The Cisco switch must be configured to have Gratuitous ARP disabled on all external interfaces.
Cisco NX OS Switch RTR Security Technical Implementation Guide
V-221083
CAT III
The Cisco switch must be configured to have IP directed broadcast disabled on all interfaces.
Cisco NX OS Switch RTR Security Technical Implementation Guide
V-221084
CAT II
The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) unreachable messages disabled on all external interfaces.
Cisco NX OS Switch RTR Security Technical Implementation Guide
V-221085
CAT II
The Cisco switch must be configured to have Internet Control Message Protocol (ICMP) redirect messages disabled on all external interfaces.
Cisco NX OS Switch RTR Security Technical Implementation Guide
V-221101
CAT III
The Cisco BGP switch must be configured to check whether a single-hop eBGP peer is directly connected.
Cisco NX OS Switch RTR Security Technical Implementation Guide
V-221110
CAT II
The Cisco BGP switch must be configured to use the maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.
Cisco NX OS Switch RTR Security Technical Implementation Guide
V-221111
CAT III
The Cisco BGP switch must be configured to limit the prefix size on any inbound route advertisement to /24, or the least significant prefixes issued to the customer.
Cisco NX OS Switch RTR Security Technical Implementation Guide
V-221124
CAT III
The Cisco PE switch must be configured to implement Internet Group Management Protocol (IGMP) or Multicast Listener Discovery (MLD) snooping for each Virtual Private LAN Services (VPLS) bridge domain.
Cisco NX OS Switch RTR Security Technical Implementation Guide
V-221135
CAT III
The Cisco multicast Rendezvous Point (RP) switch must be configured to limit the multicast forwarding cache so that its resources are not saturated by managing an overwhelming number of Protocol Independent Multicast (PIM) and Multicast Source Discovery Protocol (MSDP) source-active entries.
Cisco NX OS Switch RTR Security Technical Implementation Guide
V-221140
CAT II
The Cisco multicast Designated switch (DR) must be configured to limit the number of mroute states resulting from Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) Host Membership Reports.
Cisco NX OS Switch RTR Security Technical Implementation Guide
V-269434
CAT II
AlmaLinux OS 9 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures on impacted network interfaces are implemented.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide
V-269435
CAT II
AlmaLinux OS 9 must be configured to use TCP syncookies.
Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide