Skip to content
ATO Pathways
  Log In

IBM WebSphere Liberty Server Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • The server.xml file must be protected from unauthorized modification.

    <VulnDiscussion>When dealing with access restrictions pertaining to change control, it should be noted that any changes to the software, and/...
    Rule Medium Severity
    Show

  • SRG-APP-000400-AS-000246

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-APP-000014-AS-000009

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server Quality of Protection (QoP) must be set to use TLSv1.2 or higher.

    &lt;VulnDiscussion&gt;Quality of Protection in WebSphere Liberty specifies the security level, ciphers, and mutual authentication settings for the ...
    Rule Medium Severity
    Show

  • SRG-APP-000015-AS-000010

    <GroupDescription></GroupDescription>
    Group
    Show

  • Security cookies must be set to HTTPOnly.

    &lt;VulnDiscussion&gt;Web applications use cookies to track users across requests. These cookies, while typically not sensitive in themselves, conn...
    Rule Medium Severity
    Show

  • SRG-APP-000016-AS-000013

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server must log remote session and security activity.

    &lt;VulnDiscussion&gt;Security auditing must be configured in order to log remote session activity. Security auditing will not be performed unless ...
    Rule Medium Severity
    Show

  • SRG-APP-000033-AS-000024

    <GroupDescription></GroupDescription>
    Group
    Show

  • Users in the REST API admin role must be authorized.

    &lt;VulnDiscussion&gt;Users with console access and OS permissions to the folders where the Liberty Server is installed can make changes to the ser...
    Rule High Severity
    Show

  • SRG-APP-000109-AS-000070

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server must be configured to offload logs to a centralized system.

    &lt;VulnDiscussion&gt;Log processing failures include, but are not limited to, failures in the application server log capturing mechanisms or log s...
    Rule Medium Severity
    Show

  • SRG-APP-000119-AS-000079

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server must protect log information from unauthorized access or changes.

    &lt;VulnDiscussion&gt;WebSphere Liberty provides the capability to encrypt and sign the log data to prevent unauthorized modification. - The secu...
    Rule Medium Severity
    Show

  • SRG-APP-000121-AS-000081

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server must protect log tools from unauthorized access.

    &lt;VulnDiscussion&gt;Protecting log data also includes identifying and protecting the tools used to view and manipulate log data. Depending on the...
    Rule Medium Severity
    Show

  • SRG-APP-000126-AS-000085

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server must generate log records for authentication and authorization events.

    &lt;VulnDiscussion&gt;Enabling authentication (SECURITY_AUTHN) and authorization (SECURITY_AUTHZ) event handlers configures the server to record se...
    Rule Medium Severity
    Show

  • The WebSphere Liberty Server must be configured to encrypt log information.

    &lt;VulnDiscussion&gt;Protection of log records is of critical importance. Encrypting log records provides a level of protection that does not rely...
    Rule Medium Severity
    Show

  • SRG-APP-000133-AS-000092

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server must protect software libraries from unauthorized access.

    &lt;VulnDiscussion&gt;Application servers have the ability to specify that the hosted applications use shared libraries. The application server mus...
    Rule Medium Severity
    Show

  • SRG-APP-000142-AS-000014

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server must prohibit or restrict the use of nonsecure ports, protocols, modules, and/or services as defined in the PPSM CAL and vulnerability assessments.

    &lt;VulnDiscussion&gt;Some networking protocols may not meet organizational security requirements to protect data and components. Application serv...
    Rule Medium Severity
    Show

  • SRG-APP-000148-AS-000101

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server must use an LDAP user registry.

    &lt;VulnDiscussion&gt;To ensure accountability and prevent unauthorized access, application server users must be uniquely identified and authentica...
    Rule Medium Severity
    Show

  • SRG-APP-000148-AS-000101

    <GroupDescription></GroupDescription>
    Group
    Show

  • Basic Authentication must be disabled.

    &lt;VulnDiscussion&gt;Basic authentication does not use a centralized user store like LDAP. Not using a centralized user store complicates user man...
    Rule Medium Severity
    Show

  • SRG-APP-000149-AS-000102

    <GroupDescription></GroupDescription>
    Group
    Show

  • Multifactor authentication for network access to privileged accounts must be used.

    &lt;VulnDiscussion&gt;Multifactor authentication creates a layered defense and makes it more difficult for an unauthorized person to access the app...
    Rule High Severity
    Show

  • SRG-APP-000171-AS-000119

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server must store only encrypted representations of user passwords.

    &lt;VulnDiscussion&gt;WebSphere Liberty can either provide a local account store or integrate with enterprise account stores such as LDAP directori...
    Rule High Severity
    Show

  • SRG-APP-000172-AS-000120

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server must use TLS-enabled LDAP.

    &lt;VulnDiscussion&gt;Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmissi...
    Rule High Severity
    Show

  • SRG-APP-000177-AS-000126

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server must use DoD-issued/signed certificates.

    &lt;VulnDiscussion&gt;The cornerstone of PKI is the private key used to encrypt or digitally sign information. The key by itself is a cryptographic...
    Rule Medium Severity
    Show

  • SRG-APP-000179-AS-000129

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server must use FIPS 140-2 approved encryption modules when authenticating users and processes.

    &lt;VulnDiscussion&gt;Application servers must use and meet requirements of the DoD Enterprise PKI infrastructure for application authentication. E...
    Rule High Severity
    Show

  • SRG-APP-000295-AS-000263

    <GroupDescription></GroupDescription>
    Group
    Show

  • HTTP session timeout must be configured.

    &lt;VulnDiscussion&gt;An attacker can take advantage of user sessions that are left open, thus bypassing the user authentication process. To thwar...
    Rule Medium Severity
    Show

  • SRG-APP-000315-AS-000094

    <GroupDescription></GroupDescription>
    Group
    Show

  • Application security must be enabled on the WebSphere Liberty Server.

    &lt;VulnDiscussion&gt;Application security enables security for the applications in the environment. This type of security provides application iso...
    Rule High Severity
    Show

  • SRG-APP-000340-AS-000185

    <GroupDescription></GroupDescription>
    Group
    Show

  • Users in a reader-role must be authorized.

    &lt;VulnDiscussion&gt;The reader role is a management role that allows read-only access to select administrative REST APIs as well as the Admin Cen...
    Rule Medium Severity
    Show

  • SRG-APP-000357-AS-000038

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server must allocate JVM log record storage capacity in accordance with organization-defined log record storage requirements.

    &lt;VulnDiscussion&gt;JVM logs are logs used to store application and runtime related events, rather than audit related events. They are mainly use...
    Rule Medium Severity
    Show

  • SRG-APP-000380-AS-000088

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server must prohibit the use of cached authenticators after an organization-defined time period.

    &lt;VulnDiscussion&gt;Larger authentication cache timeout values can increase security risks. For example, a user who is revoked can still log in b...
    Rule Medium Severity
    Show

  • SRG-APP-000428-AS-000265

    <GroupDescription></GroupDescription>
    Group
    Show

  • The WebSphere Liberty Server LTPA keys password must be changed.

    &lt;VulnDiscussion&gt;The default location of the automatically generated Lightweight Third Party Authentication (LTPA) keys file is ${server.outpu...
    Rule Medium Severity
    Show

  • SRG-APP-000439-AS-000274

    <GroupDescription></GroupDescription>
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules