documentation_complete: true

title: 'Disable Or Secure Remote Access'

description: |-
    Remote access must be secured so it is accessible by trusted
    administrators only. If this condition is not met, the access must be
    disabled from the deployment.

rationale: |-
    Failure to secure against unauthorized access can quickly lead to system
    compromise. The default access included with JBoss is a well-known attack
    vector that can be leveraged to load malicious code to be executed on the
    server.

severity: high

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: AC-3

ocil_clause: 'remote access is not secured or disabled'
