Enable the Kerberos TGT expiration warning, as appropriate., CC ID: 05263
Configure the sendmail greeting properly., CC ID: 05264
Set the Electrically-Erasable Programmable Read-Only Memory warning message properly., CC ID: 05265
Set the warning messages switchpoint distance to an appropriate value., CC ID: 05266
SELECTED AUTHORITY DOCUMENTS COMPLIED WITH
Each system should have a logon banner that requires a user response before the user can gain access to the system. The legal department should be consulted for the appropriate wording of the banner. (§ 3.6.31, Australian Government ICT Security Manual (ACSI 33))
An access warning should be displayed when a user opens Terminal locally or remotely. This warning should state who owns the computer, warn against unauthorized use, and remind authorized users of their consent to monitoring. (Pg 40, Mac OS X Security Configuration for version 10.4 or later, second edition, Second Edition)
The business integrity of e-mail messages should be protected by warning users that the use of e-mail may be monitored. (CF.15.01.08b-2, The Standard of Good Practice for Information Security)
The customer access sign-on process should include displaying contractual conditions that limit the liabilities of the organization to customers (e.g., through the use of using on-screen warnings). (CF.05.03.06b, The Standard of Good Practice for Information Security)
The business integrity of e-mail messages should be protected by warning users that the contents of e-mail messages may be legally and contractually binding. (CF.15.01.08b-1, The Standard of Good Practice for Information Security)
The business integrity of e-mail messages should be protected by warning users that the use of e-mail may be monitored. (CF.15.01.08b-2, The Standard of Good Practice for Information Security, 2013)
The customer access sign-on process should include displaying contractual conditions that limit the liabilities of the organization to customers (e.g., through the use of using on-screen warnings). (CF.05.03.06b, The Standard of Good Practice for Information Security, 2013)
The business integrity of e-mail messages should be protected by warning users that the contents of e-mail messages may be legally and contractually binding. (CF.15.01.08b-1, The Standard of Good Practice for Information Security, 2013)
A login banner should be displayed on every system to each user that is attempting to log in. The banner should not reveal the purpose of the computer or the operating system and should be reviewed by legal counsel. The organization should ensure the system has the necessary warning banners that sta… (Action 1.1.4, Special Action 4.1, SANS Computer Security Incident Handling, Version 2.3.1)
A warning banner should be displayed to all users prior to the identification and authentication process. This banner should state the appropriate and inappropriate uses of the product. (§ 17.4, § L.4, ISO 15408-2 Common Criteria for Information Technology Security Evaluation Part 2, 2008)
Appropriate warning banners should be applied to the system to notify users of their rights and that they may be monitored to detect unauthorized use. (§ 15.1.5, ISO 27002 Code of practice for information security management, 2005)
Table F-1: For Windows 2000 Server, the organization must configure the system to use an HHS accepted warning banner.
Table F-2: For Windows 2003 Server, the organization must configure the system to use an HHS accepted warning banner.
Table F-6: For Solaris, the organization must configure the syst… (Table F-1, Table F-2, Table F-6, CMS Business Partners Systems Security Manual, Rev. 10)
The system must provide an opening warning banner that states the system is for authorized use only and all activity will be monitored. (CSR 10.8.3, Pub 100-17 Medicare Business Partners Systems Security, Transmittal 7, Appendix A: CMS Core Security Requirements CSR, March 17, 2006)
The Information Assurance Officer should ensure a warning banner is displayed prior to sign-on of Demand and FTP sessions. The banner also should be displayed after a successful logon and remain displayed until the user presses a key. This banner should include the following, at a minimum: the name … (§ 2.3.3.5, Defense Information Systems Agency UNISYS Security Technical Implementation Guide Version 7 Release 2, 28 August 2006)
Network devices that use SSH, Telnet, FTP, or HTTP must display warning banners. (§ 6.2, DISA Secure Remote Computing Security Technical Implementation Guide, Version 1 Release 2)
Users must be warned they are entering a government Information System. (ECWM-1, DoD Instruction 8500.2 Information Assurance (IA) Implementation)
Users entering a government Information System must be shown privacy notices and security notices on the screen that includes notifying them they are subject to recording, monitoring, and auditing. (ECWM-1, DoD Instruction 8500.2 Information Assurance (IA) Implementation)
The system must display a banner prior to user logon. The banner must warn that the user will be monitored and recorded, unauthorized use is not permitted, and the user can be subject to civil and criminal penalties. The wording of the banner must be approved by the cognizant security agency. (§ 8-609.a(1), NISPOM - National Industrial Security Program Operating Manual (DoD 5220.22-M) February 26, 2006, February 28, 2006)
Computers should display a warning banner advising users of the safeguarding requirements for confidential information. An approved system notification banner must be displayed before granting access to the system. (§ 5.1, § 5.6.1, Exhibit 4 AC-8, IRS Publication 1075: TAX INFORMATION SECURITY GUIDELINES FOR FEDERAL, STATE AND LOCAL AGENCIES AND ENTITIES; Safeguards for Protecting Federal Tax Returns and Return Information)
Organizational records and documents should be examined to ensure a notification message is displayed prior to users gaining access to the system. The message should tell users they are accessing the organization's system, the use of the system may be monitored and recorded, by proceeding, users con… (AC-8, AC-8.4, Guide for Assessing the Security Controls in Federal Information Systems, NIST SP 800-53A)
