Check: SOL-11.1-090120
Solaris 11 SPARC STIG:
SOL-11.1-090120
(in versions v2 r10 through v1 r14)
Title
The operating system must prevent non-privileged users from circumventing malicious code protection capabilities. (Cat II impact)
Discussion
In order to minimize potential negative impact to the organization caused by malicious code, it is imperative that malicious code is identified and eradicated prior to entering protected enclaves via operating system entry and exit points. The requirement states that AV and malware protection applications must be used at entry and exit points. For the operating system, this means an anti-virus application must be installed on machines that are the entry and exit points.
Check Content
The operator will ensure that anti-virus software is installed and operating. If the operator is unable to provide a documented configuration for an installed anti-virus software system or if not properly used, this is a finding.
Fix Text
The operator will ensure that anti-virus software is installed and operating.
Additional Identifiers
Rule ID: SV-224670r854547_rule
Vulnerability ID: V-224670
Group Title: SRG-OS-000324
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001248 |
The information system prevents non-privileged users from circumventing malicious code protection capabilities. |
| CCI-002235 |
The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. |
Controls
| Number | Title |
|---|---|
| AC-6 (10) |
Prohibit Non-Privileged Users From Executing Privileged Functions |