SC-05 Denial-of-service Protection
NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
All changes in this version
Title
Denial-of-service Protection
Control
a. [Selection: protect against; limit] the effects of the following types of denial-of-service events: [Assignment: types of denial-of-service events] ; and
b. Employ the following controls to achieve the denial-of-service objective: [Assignment: controls by type of denial-of-service event].
Discussion
Denial-of-service events may occur due to a variety of internal and external causes, such as an attack by an adversary or a lack of planning to support organizational needs with respect to capacity and bandwidth. Such attacks can occur across a wide range of network protocols (e.g., IPv4, IPv6). A variety of technologies are available to limit or eliminate the origination and effects of denial-of-service events. For example, boundary protection devices can filter certain types of packets to protect system components on internal networks from being directly affected by or the source of denial-of-service attacks. Employing increased network capacity and bandwidth combined with service redundancy also reduces the susceptibility to denial-of-service events.
Parameters
sc-05_odp.01: types of denial-of-service events
sc-05_odp.02: [protect against; limit]
sc-05_odp.03: controls by type of denial-of-service event
Related controls
cp-2, ir-4, sc-40, sc-6, sc-7
STIG rules that implement this control 45
Application Security and Development V6R5
- APSC-DV-002390 CAT II XML-based applications must mitigate DoS attacks by using XML filters, parser options, or gateways.
- APSC-DV-003320 CAT II Protections against DoS attacks must be implemented.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-251025 CAT II Ubuntu 22.04 LTS must configure the Uncomplicated Firewall (ufw) to rate-limit impacted network interfaces.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-600200 CAT II Ubuntu 24.04 LTS must configure the uncomplicated firewall to rate-limit impacted network interfaces.
Microsoft Windows 11 V2R11
- WN11-CC-000035 CAT III The system must be configured to ignore NetBIOS name release requests except from WINS servers.
- WN11-CC-000220 CAT III File Explorer heap termination on corruption must be disabled.
Microsoft Windows Server 2022 V2R11
- WN22-CC-000060 CAT III Windows Server 2022 must be configured to ignore NetBIOS name release requests except from WINS servers.
Microsoft Windows Server 2025 V1R4
- WN25-CC-000060 CAT III Windows Server 2025 must be configured to ignore NetBIOS name release requests except from WINS servers.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-000530 CAT II RHEL 10 must use a separate file system for user home directories (such as "/home" or an equivalent).
- RHEL-10-000540 CAT II RHEL 10 must use a separate file system for "/tmp".
- RHEL-10-000550 CAT II RHEL 10 must use a separate file system for "/var".
- RHEL-10-000560 CAT II RHEL 10 must use a separate file system for "/var/log".
- RHEL-10-000570 CAT II RHEL 10 must use a separate file system for "/var/tmp".
- RHEL-10-200643 CAT II RHEL 10 must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.
- RHEL-10-400160 CAT II RHEL 10 must ensure that all local interactive user home directories are group-owned by the home directory owner's primary group.
- RHEL-10-600180 CAT II RHEL 10 must assign a home directory to all local interactive users in the "/etc/passwd" file.
- RHEL-10-600190 CAT II RHEL 10 must ensure that all local interactive user home directories defined in the "/etc/passwd" file must exist.
- RHEL-10-700820 CAT II RHEL 10 must prevent a user from overriding the Ctrl-Alt-Del sequence settings for the graphical user interface.
- RHEL-10-700830 CAT II RHEL 10 must disable the ability of a user to accidentally press Ctrl-Alt-Del and cause a system to shut down or reboot.
- RHEL-10-800060 CAT II RHEL 10 must have at least two name servers configured for systems using Domain Name Server (DNS) resolution.
- RHEL-10-800080 CAT II RHEL 10 must be configured to use Transmission Control Protocol (TCP) syncookies.
- RHEL-10-800090 CAT II RHEL 10 must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.
- RHEL-10-800100 CAT II RHEL 10 must not forward Internet Protocol version 4 (IPv4) source-routed packets.
- RHEL-10-800110 CAT II RHEL 10 must log Internet Protocol version 4 (IPv4) packets with impossible addresses.
- RHEL-10-800120 CAT II RHEL 10 must log Internet Protocol version 4 (IPv4) packets with impossible addresses by default.
- RHEL-10-800130 CAT II RHEL 10 must use reverse path filtering on all Internet Protocol version 4 (IPv4) interfaces.
- RHEL-10-800140 CAT II RHEL 10 must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted.
- RHEL-10-800150 CAT II RHEL 10 must not forward Internet Protocol version 4 (IPv4) source-routed packets by default.
- RHEL-10-800160 CAT II RHEL 10 must use a reverse-path filter for Internet Protocol version 4 (IPv4) network traffic when possible by default.
- RHEL-10-800170 CAT II RHEL 10 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.
- RHEL-10-800180 CAT II RHEL 10 must limit the number of bogus Internet Control Message Protocol (ICMP) response errors logs.
- RHEL-10-800190 CAT II RHEL 10 must not send Internet Control Message Protocol (ICMP) redirects.
- RHEL-10-800200 CAT II RHEL 10 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default.
- RHEL-10-800210 CAT II RHEL 10 must not enable Internet Protocol version 4 (IPv4) packet forwarding unless the system is a router.
- RHEL-10-800220 CAT II RHEL 10 must not accept router advertisements on all Internet Protocol version 6 (IPv6) interfaces.
- RHEL-10-800230 CAT II RHEL 10 must ignore IPv6 Internet Control Message Protocol (ICMP) redirect messages.
- RHEL-10-800240 CAT II RHEL 10 must not forward Internet Protocol version 6 (IPv6) source-routed packets.
- RHEL-10-800250 CAT II RHEL 10 must not enable Internet Protocol version 6 (IPv6) packet forwarding unless the system is a router.
- RHEL-10-800260 CAT II RHEL 10 must not accept router advertisements on all Internet Protocol version 6 (IPv6) interfaces by default.
- RHEL-10-800270 CAT II RHEL 10 must prevent Internet Protocol version 6 (IPv6) Internet Control Message Protocol (ICMP) redirect messages from being accepted.
- RHEL-10-800280 CAT II RHEL 10 must not forward Internet Protocol version 6 (IPv6) source-routed packets by default.
- RHEL-10-800290 CAT II RHEL 10 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring that rate-limiting measures on impacted network interfaces are implemented.
- RHEL-10-800300 CAT II RHEL 10 must configure a DNS processing mode in Network Manager to avoid conflicts with other Domain Name Server (DNS) managers and to not leak DNS queries to untrusted networks.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-251030 CAT II RHEL 9 must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring rate-limiting measures on impacted network interfaces are implemented.
- RHEL-09-253010 CAT II RHEL 9 must be configured to use TCP syncookies.