Skip to content
ATO Pathways
  Log In

Application Security and Development Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Unnecessary built-in application accounts must be disabled.

    <VulnDiscussion>Default passwords and properties of built-in accounts are often publicly available. Anyone with necessary knowledge, internal...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • Default passwords must be changed.

    &lt;VulnDiscussion&gt;Default passwords can easily be compromised by attackers allowing immediate access to the applications.&lt;/VulnDiscussion&gt...
    Rule High Severity
    Show

  • The designer must ensure uncategorized or emerging mobile code is not used in applications.

    &lt;VulnDiscussion&gt;By definition, mobile code is software obtained from remote systems outside the enclave boundary, transferred across a networ...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • Production database exports must have database administration credentials and sensitive data removed before releasing the export.

    &lt;VulnDiscussion&gt;Production database exports are often used to populate development databases. Test and development environments do not typica...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • Protections against DoS attacks must be implemented.

    &lt;VulnDiscussion&gt;Known DoS threats documented in the threat model should be mitigated, to prevent DoS type attacks.&lt;/VulnDiscussion&gt;&lt;...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • The system must alert an administrator when low resource conditions are encountered.

    &lt;VulnDiscussion&gt;In order to prevent DoS type attacks, applications should be monitored when resource conditions reach a predefined threshold....
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • At least one application administrator must be registered to receive update notifications, or security alerts, when automated alerts are available.

    &lt;VulnDiscussion&gt;Administrators should register for updates to all COTS and custom-developed software, so when security flaws are identified, ...
    Rule Low Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • The application must provide notifications or alerts when product update and security related patches are available.

    &lt;VulnDiscussion&gt;An application vulnerability management and update process must be in place to notify and provide users and administrators wi...
    Rule Low Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • Connections between the DoD enclave and the Internet or other public or commercial wide area networks must require a DMZ.

    &lt;VulnDiscussion&gt;In order to protect DoD data and systems, all remote access to DoD information systems must be mediated through a managed acc...
    Rule Medium Severity
    Show

  • SRG-APP-000506

    <GroupDescription></GroupDescription>
    Group
    Show

  • The application must generate audit records when concurrent logons from different workstations occur.

    &lt;VulnDiscussion&gt;When an application provides users with the ability to concurrently logon, an event must be recorded that indicates the user ...
    Rule Low Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • The Program Manager must verify all levels of program management, designers, developers, and testers receive annual security training pertaining to their job function.

    &lt;VulnDiscussion&gt;Many application team members may not be aware of the security implications regarding the code that they design, write and te...
    Rule Medium Severity
    Show

  • APSC-DV-002010

    <GroupDescription></GroupDescription>
    Group
    Show

  • The application must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

    &lt;VulnDiscussion&gt;Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect classified data. The...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules