Application Server Security Requirements Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000148
Group -
SRG-APP-000149
Group -
The application server must use multifactor authentication for network access to privileged accounts.
Multifactor authentication creates a layered defense and makes it more difficult for an unauthorized person to access the application server. If one factor is compromised or broken, the attacker s...Rule High Severity -
SRG-APP-000151
Group -
SRG-APP-000153
Group -
The application server must authenticate users individually prior to using a group authenticator.
To ensure individual accountability and prevent unauthorized access, application server users (and any processes acting on behalf of application server users) must be individually identified and au...Rule Medium Severity -
SRG-APP-000156
Group -
SRG-APP-000163
Group -
The application server must disable identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Inactive identifiers pose a risk to systems and applications. Attackers that are able to exploit an inactive identifier can potentially obtain and maintain undetected access to the application. Own...Rule Medium Severity -
SRG-APP-000171
Group -
SRG-APP-000172
Group -
SRG-APP-000172
Group -
The application server must utilize encryption when using LDAP for authentication.
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. Application servers have the capability to utilize LDAP directorie...Rule Medium Severity -
SRG-APP-000175
Group -
SRG-APP-000176
Group -
SRG-APP-000177
Group -
The application server must map the authenticated identity to the individual user or group account for PKI-based authentication.
The cornerstone of PKI is the private key used to encrypt or digitally sign information. The key by itself is a cryptographic value that does not contain specific user information, but the key can ...Rule Medium Severity -
SRG-APP-000178
Group -
SRG-APP-000179
Group -
The application server must utilize FIPS 140-2 approved encryption modules when authenticating users and processes.
Encryption is only as good as the encryption modules utilized. Unapproved cryptographic module algorithms cannot be verified and cannot be relied upon to provide confidentiality or integrity, and ...Rule High Severity -
SRG-APP-000181
Group -
SRG-APP-000206
Group -
The application server must identify prohibited mobile code.
Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution ...Rule Medium Severity -
SRG-APP-000211
Group -
SRG-APP-000219
Group -
SRG-APP-000220
Group -
The application server must invalidate session identifiers upon user logout or other session termination.
If communications sessions remain open for extended periods of time even when unused, there is the potential for an adversary to hijack the session and use it to gain access to the device or networ...Rule Medium Severity -
SRG-APP-000223
Group -
The application server must generate a unique session identifier for each session.
Unique session IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session identifiers help to reduce predictability of session identifier...Rule Medium Severity -
SRG-APP-000223
Group -
The application server must recognize only system-generated session identifiers.
This requirement focuses on communications protection at the application session, versus network packet level. The intent of this control is to establish grounds for confidence at each end of a com...Rule Medium Severity -
SRG-APP-000224
Group -
SRG-APP-000225
Group -
The application server must be configured to perform complete application deployments.
Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. When an applic...Rule Medium Severity -
SRG-APP-000225
Group -
The application server must provide a clustering capability.
This requirement is dependent upon system MAC and confidentiality. If the system MAC and confidentiality levels do not specify redundancy requirements, this requirement is NA. Failure to a known s...Rule Medium Severity -
SRG-APP-000225
Group -
The application server must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.
Fail-secure is a condition achieved by the application server in order to ensure that in the event of an operational failure, the system does not enter into an unsecure state where intended securit...Rule Medium Severity -
SRG-APP-000231
Group -
SRG-APP-000231
Group -
The application server must employ cryptographic mechanisms to ensure confidentiality and integrity of all information at rest when stored off-line.
This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. Information at rest refers to ...Rule Medium Severity -
SRG-APP-000251
Group -
SRG-APP-000266
Group -
SRG-APP-000266
Group -
SRG-APP-000267
Group -
The application server must restrict error messages only to authorized users.
If the application provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be caref...Rule Medium Severity -
SRG-APP-000290
Group -
The application server must use cryptographic mechanisms to protect the integrity of log tools.
Protecting the integrity of the tools used for logging purposes is a critical step in ensuring the integrity of log data. Log data includes all information (e.g., log records, log settings, and log...Rule Medium Severity -
SRG-APP-000295
Group -
SRG-APP-000296
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.