The system must be configured to only boot from the system boot device.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-227073	GEN008600	SV-227073r603265_rule		High

Description
The ability to boot from removable media is the same as being able to boot into single user or maintenance mode without a password. This ability could allow a malicious user to boot the system and perform changes possibly compromising or damaging the system. It could also allow the system to be used for malicious purposes by a malicious anonymous user.

STIG	Date
Solaris 10 SPARC Security Technical Implementation Guide	2022-09-07

Details

Check Text ( C-29235r485597_chk )
Determine if the system is configured to boot from devices other than the system startup media. If so, this is a finding. In most cases, this will require access to the BIOS or system controller. The exact procedure will be hardware-dependent, and the SA should be consulted to identify the specific configuration. In the event the BIOS or system controller is not accessible without adversely impacting (e.g., restarting) the system, the SA may be interviewed to determine compliance with the requirement.

Check Text ( C-29235r485597_chk )

Determine if the system is configured to boot from devices other than the system startup media. If so, this is a finding.

In most cases, this will require access to the BIOS or system controller. The exact procedure will be hardware-dependent, and the SA should be consulted to identify the specific configuration. In the event the BIOS or system controller is not accessible without adversely impacting (e.g., restarting) the system, the SA may be interviewed to determine compliance with the requirement.

Fix Text (F-29223r485598_fix)
Configure the system to only boot from system startup media.