Skip to content
ATO Pathways
  Log In

Application Security and Development Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • At least one application administrator must be registered to receive update notifications, or security alerts, when automated alerts are available.

    &lt;VulnDiscussion&gt;Administrators should register for updates to all COTS and custom-developed software, so when security flaws are identified, ...
    Rule Low Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • The application must provide notifications or alerts when product update and security related patches are available.

    &lt;VulnDiscussion&gt;An application vulnerability management and update process must be in place to notify and provide users and administrators wi...
    Rule Low Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • Connections between the DoD enclave and the Internet or other public or commercial wide area networks must require a DMZ.

    &lt;VulnDiscussion&gt;In order to protect DoD data and systems, all remote access to DoD information systems must be mediated through a managed acc...
    Rule Medium Severity
    Show

  • SRG-APP-000506

    <GroupDescription></GroupDescription>
    Group
    Show

  • The application must generate audit records when concurrent logons from different workstations occur.

    &lt;VulnDiscussion&gt;When an application provides users with the ability to concurrently logon, an event must be recorded that indicates the user ...
    Rule Low Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Program Manager must verify all levels of program management, designers, developers, and testers receive annual security training pertaining to their job function.

    &lt;VulnDiscussion&gt;Many application team members may not be aware of the security implications regarding the code that they design, write and te...
    Rule Medium Severity
    Show

  • APSC-DV-002010

    <GroupDescription></GroupDescription>
    Group
    Show

  • The application must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

    &lt;VulnDiscussion&gt;Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect classified data. The...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules