SSH
What is SSH?
Secure Shell, a cryptographic network protocol for secure remote login, command execution, and file transfer between computers over unsecured networks.
Terms that appear alongside ssh
Each of these is named in at least one of the same controls as ssh. The number is how many controls name both.
- authentication 7 shared controls
- tls 6 shared controls
- nist 5 shared controls
- ipsec 5 shared controls
- remote access 4 shared controls
- firewall 3 shared controls
- pki 3 shared controls
- audit 2 shared controls
Frameworks that govern ssh
What the standards actually require on ssh
Requirements naming ssh across 6 standards, quoted from the control text.
Agencies should apply parameter checking when they use the 'forced command' option.
new-zealand-information-security-manual-nzism::17.5.8.C.01 · 17.5.8.C.01 Parameter checking for SSH forced commands →If using remote access without the use of a password for SSH connections, the 'forced command' option is used to specify what command is executed and parameter checking is enabled.
ISM-0488 · Forced commands for passwordless SSH access →Implement cryptography + protocol security + PKI per O-RAN WG11 Security Requirements covering TLS + SSH + IPsec + certificate lifecycle.
ORANWG11-3 · Cryptography, TLS, SSH, IPsec, and PKI Lifecycle Management →Passing criterion delivery_mitm (MUST; group Security, Secured delivery against man-in-the-middle (MITM) attacks). Criterion text: The project MUST use a delivery mechanism that counters MITM attacks. Using https or ssh+scp is acceptable.
openssf-best-practices-badge-criteria::passing.delivery_mitm · delivery_mitm (Passing, MUST) →Manage network infrastructure securely, for example by keeping its configuration as infrastructure-as-code under version control and by using secure protocols such as SSH and HTTPS.
CIS-12.3 · Securely Manage Network Infrastructure →Manage network infrastructure securely, for example by holding device configuration as code under version control and administering over secure protocols such as SSH and HTTPS. Implementation Groups: IG2 and IG3 (not in the IG1 baseline;
cis-controls-v8-1::12.3 · Securely Manage Network Infrastructure →Questions people ask about ssh
What is SSH?
Why is SSH important for compliance?
Which compliance frameworks address SSH?
Where can I learn more about SSH?
See how SSH applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.