SV-25004r2: Software certificate installation files must be removed from a system. | Windows 7 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

Software certificate installation files must be removed from a system.

Description

Discussion Text

Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366

Additional Details

Third-Party Tools

Responsibility

System Administrator

References

DPMS Target Windows 7 DISA DPMS Target Windows 7 1712

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.windows:def:4397
files=$(find / -type f -name "*.p12" -o -name "*.pfx" 2>/dev/null)
if [ -z "$files" ]; then echo "PASS"; else echo "FAIL"; fi
exit 0

Remediation

Remove any certificate installation files found on a system.

				This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager).