# NIST SP 800-53 Low Impact Baseline Compliance Report

## Target Information
- IP Address: 172.16.100.74
- Scan Date: 2025-07-23 13:32:43
- System Type: Ubuntu Linux with OpenSSH 8.2p1 and Nginx 1.18.0

## Executive Summary

The technical validation of the system against NIST SP 800-53 Low Impact Baseline controls has been completed. The assessment revealed:

- **Compliant Controls**: 1
- **Non-Compliant Controls**: 1
- **Not Applicable Controls**: 0
- **Not Tested Controls**: 7

The system demonstrates compliance with the principle of least functionality but lacks proper implementation of cryptographic protection for web services. Most controls require administrative access for complete validation.

## Control Evaluation Results

### AC-2: Account Management
- **Description**: The organization manages information system accounts.
- **Status**: NOT TESTED

#### Findings
- Unable to fully assess account management practices without administrative access
- SSH service is available but authentication methods could not be fully enumerated

#### Recommendations
- Implement robust account management procedures
- Consider implementing centralized authentication for all services

### AC-3: Access Enforcement
- **Description**: The information system enforces approved authorizations for logical access.
- **Status**: NOT TESTED

#### Findings
- Web server returns 404 for admin directory access attempts
- Access control headers are present in HTTP responses, indicating some level of access control implementation
- Access-Control-Allow-Origin is set to "*", which may be overly permissive

#### Recommendations
- Implement proper access controls for web resources
- Review CORS policy to ensure it's not overly permissive

### AC-7: Unsuccessful Logon Attempts
- **Description**: The information system enforces a limit of consecutive invalid logon attempts.
- **Status**: NOT TESTED

#### Findings
- System is running OpenSSH which can be configured to limit unsuccessful logon attempts
- Full verification requires administrative access to check /etc/ssh/sshd_config for MaxAuthTries setting

#### Recommendations
- Ensure MaxAuthTries is set to 5 or fewer in SSH configuration
- Implement account lockout policies across all authentication mechanisms

### AC-17: Remote Access
- **Description**: The organization establishes secure remote access mechanisms.
- **Status**: NOT TESTED

#### Findings
- SSH service is available for remote access
- SSH appears to be running a current version (OpenSSH 8.2p1)

#### Recommendations
- Ensure SSH is configured according to organizational security policies
- Consider implementing additional access controls like IP restrictions

### AU-2: Audit Events
- **Description**: The information system can audit relevant events.
- **Status**: NOT TESTED

#### Findings
- System is running Nginx which can be configured for audit logging
- Full verification requires administrative access to check nginx configuration

#### Recommendations
- Ensure Nginx access and error logs are properly configured
- Implement centralized log management and monitoring

### CM-7: Least Functionality
- **Description**: The organization configures the information system to provide only essential capabilities.
- **Status**: COMPLIANT

#### Findings
- System has only 2 open ports (22/SSH and 80/HTTP), indicating adherence to least functionality principle
- No unnecessary services were detected during scanning

### SC-7: Boundary Protection
- **Description**: The information system monitors and controls communications at system boundaries.
- **Status**: NOT TESTED

#### Findings
- Unable to determine if boundary protection measures are in place
- No firewall or filtering was conclusively detected

#### Recommendations
- Implement host-based firewall to filter network traffic
- Consider deploying network-based security controls

### SC-13: Cryptographic Protection
- **Description**: The information system implements cryptographic mechanisms.
- **Status**: NON-COMPLIANT

#### Findings
- Web server does not support HTTPS
- SSH service implements cryptographic protection
- System lacks TLS implementation for web services

#### Recommendations
- Implement HTTPS with a valid certificate
- Configure TLS 1.2 or 1.3 only, with secure cipher suites

### IA-5: Authenticator Management
- **Description**: The organization manages system authenticators.
- **Status**: NOT TESTED

#### Findings
- SSH service provides authentication mechanisms
- Unable to fully assess authenticator management practices

#### Recommendations
- Consider implementing key-based authentication only for SSH
- Ensure password policies meet organizational requirements

## Conclusion

The target system at 172.16.100.74 shows partial compliance with the NIST SP 800-53 Low Impact Baseline. The system implements the principle of least functionality effectively but lacks proper cryptographic protection for web services. Most controls require administrative access for complete validation.

To improve compliance, the organization should focus on:

1. Implementing HTTPS for web services
2. Reviewing access control mechanisms
3. Ensuring proper logging and audit capabilities
4. Implementing proper account management policies
5. Configuring SSH according to security best practices

A follow-up assessment with administrative access is recommended to fully evaluate compliance with the NIST SP 800-53 Low Impact Baseline.