SI-06 Security and Privacy Function Verification
All changes in this version
Title
Security and Privacy Function Verification
Control
a. Verify the correct operation of [Assignment: organization-defined security and privacy functions];
b. Perform the verification of the functions specified in SI-6a [Selection (one or more): {{ insert: param, si-06_odp.04 }} ; upon command by user with appropriate privilege; {{ insert: param, si-06_odp.05 }} ];
c. Alert [Assignment: personnel or roles] to failed security and privacy verification tests; and
d. [Selection (one or more): shut the system down; restart the system; {{ insert: param, si-06_odp.08 }} ] when anomalies are discovered.
Discussion
Transitional states for systems include system startup, restart, shutdown, and abort. System notifications include hardware indicator lights, electronic alerts to system administrators, and messages to local computer consoles. In contrast to security function verification, privacy function verification ensures that privacy functions operate as expected and are approved by the senior agency official for privacy or that privacy attributes are applied or used as expected.
Parameters
si-6_prm_1: organization-defined security and privacy functions
si-06_odp.01: security functions
si-06_odp.02: privacy functions
si-06_odp.03: [{{ insert: param, si-06_odp.04 }} ; upon command by user with appropriate privilege; {{ insert: param, si-06_odp.05 }} ]
si-06_odp.04: system transitional states
si-06_odp.05: frequency
si-06_odp.06: personnel or roles
si-06_odp.07: [shut the system down; restart the system; {{ insert: param, si-06_odp.08 }} ]
si-06_odp.08: alternative action(s)
Related controls
ca-7, cm-4, cm-6, si-7
STIG rules that implement this control 34
Apple macOS 15 (Sequoia) V1R8
- APPL-15-005100 CAT II The macOS system must ensure Secure Boot level is set to "full".
Apple macOS 26 (Tahoe) V1R4
- APPL-26-005100 CAT II The macOS system must ensure Secure Boot level is set to "full".
Application Security and Development V6R5
- APSC-DV-002760 CAT II The application performing organization-defined security functions must verify correct operation of security functions.
- APSC-DV-002770 CAT II The application must perform verification of the correct operation of security functions: upon system startup and/or restart; upon command by a user with privileged access; and/or every 30 days.
- APSC-DV-002780 CAT III The application must notify the ISSO and ISSM of failed security verification tests.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-412040 CAT II Ubuntu 22.04 LTS must not assign an interactive login shell for system accounts.
- UBTU-22-651010 CAT II Ubuntu 22.04 LTS must use a file integrity tool to verify correct operation of all security functions.
- UBTU-22-651015 CAT II Ubuntu 22.04 LTS must configure Advanced Intrusion Detection Environment (AIDE) to perform file integrity checking on the file system.
- UBTU-22-651020 CAT II Ubuntu 22.04 LTS must notify designated personnel if baseline configurations are changed in an unauthorized manner. The file integrity tool must notify the system administrator when changes to the baseline configuration or anomalies in the operation of any security functions are discovered.
- UBTU-22-651025 CAT II Ubuntu 22.04 LTS must be configured so that the script that runs each 30 days or less to check file integrity is the default.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100100 CAT II Ubuntu 24.04 LTS must use a file integrity tool to verify correct operation of all security functions.
- UBTU-24-100110 CAT II Ubuntu 24.04 LTS must configure AIDE to perform file integrity checking on the file system if installed.
- UBTU-24-100120 CAT II Ubuntu 24.04 LTS must be configured so that the script which runs each 30 days or less to check file integrity is the default one.
- UBTU-24-100130 CAT II Ubuntu 24.04 LTS must notify designated personnel if baseline configurations are changed in an unauthorized manner. The file integrity tool must notify the system administrator (SA) when changes to the baseline configuration or anomalies in the operation of any security functions are discovered.
- UBTU-24-101100 CAT II Ubuntu 24.04 LTS must not assign an interactive login shell for system accounts.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200630 CAT II RHEL 10 must have the Advanced Intrusion Detection Environment (AIDE) package installed.
- RHEL-10-200633 CAT II RHEL 10 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered.
- RHEL-10-400130 CAT II RHEL 10 must be configured so that cron configuration file directories are owned by root.
- RHEL-10-600020 CAT II RHEL 10 must not assign an interactive login shell for system accounts.
- RHEL-10-600520 CAT II RHEL 10 must restrict privilege elevation to authorized personnel.
- RHEL-10-700400 CAT II RHEL 10 must enable the SELinux targeted policy.
- RHEL-10-700420 CAT II RHEL 10 must use a Linux Security Module configured to enforce limits on system services.
- RHEL-10-700500 CAT II RHEL 10 must be configured so that Secure Shell (SSH) public host key files have mode "0644" or less permissive.
- RHEL-10-700530 CAT II RHEL 10 must be configured so that the Secure Shell (SSH) daemon does not allow rhosts authentication.
- RHEL-10-700540 CAT II RHEL 10 must be configured so that the Secure Shell (SSH) daemon does not allow known hosts authentication.
- RHEL-10-700550 CAT II RHEL 10 must be configured so that the Secure Shell (SSH) daemon disables remote X connections for interactive users.
- RHEL-10-700560 CAT II RHEL 10 must be configured so that the Secure Shell (SSH) daemon performs strict mode checking of home directory configuration files.
- RHEL-10-700570 CAT II RHEL 10 must be configured so that the Secure Shell (SSH) daemon displays the date and time of the last successful account login upon an SSH login.
- RHEL-10-700580 CAT II RHEL 10 must be configured so that the Secure Shell (SSH) daemon prevents remote hosts from connecting to the proxy display.
- RHEL-10-700810 CAT II RHEL 10 must prevent a user from overriding the disable-restart-buttons setting for the graphical user interface.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-431010 CAT I RHEL 9 must use a Linux Security Module configured to enforce limits on system services.
- RHEL-09-431015 CAT II RHEL 9 must enable the SELinux targeted policy.
- RHEL-09-651010 CAT II RHEL 9 must have the AIDE package installed.
- RHEL-09-651015 CAT II RHEL 9 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered.