IBM WebSphere Liberty Server Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000001-AS-000001
Group -
Maximum in-memory session count must be set according to application requirements.
Application management includes the ability to control the number of sessions that use an application by all accounts and/or account types. Limiting the number of allowed sessions is helpful in lim...Rule Medium Severity -
The WebSphere Liberty Server Quality of Protection (QoP) must be set to use TLSv1.2 or higher.
Quality of Protection in WebSphere Liberty specifies the security level, ciphers, and mutual authentication settings for the Secure Socket Layer (SSL/TLS) configuration. For Quality of Protection s...Rule Medium Severity -
Security cookies must be set to HTTPOnly.
Web applications use cookies to track users across requests. These cookies, while typically not sensitive in themselves, connect to the existing state on the back-end system. If an intruder were to...Rule Medium Severity -
The WebSphere Liberty Server must log remote session and security activity.
Security auditing must be configured in order to log remote session activity. Security auditing will not be performed unless the audit feature (audit-1.0) has been enabled. The security feature (ap...Rule Medium Severity -
Users in the REST API admin role must be authorized.
Users with console access and OS permissions to the folders where the Liberty Server is installed can make changes to the server. In addition, REST API calls that execute server management tasks ar...Rule High Severity -
The WebSphere Liberty Server must be configured to offload logs to a centralized system.
Log processing failures include, but are not limited to, failures in the application server log capturing mechanisms or log storage capacity being reached or exceeded. In some instances, it is pref...Rule Medium Severity -
The WebSphere Liberty Server must protect log information from unauthorized access or changes.
WebSphere Liberty provides the capability to encrypt and sign the log data to prevent unauthorized modification. - The security feature (appSecurity-2.0) must be defined in order to configure a u...Rule Medium Severity -
The WebSphere Liberty Server must protect log tools from unauthorized access.
Protecting log data also includes identifying and protecting the tools used to view and manipulate log data. Depending on the log format and application, system and application log tools may provid...Rule Medium Severity -
The WebSphere Liberty Server must be configured to encrypt log information.
Protection of log records is of critical importance. Encrypting log records provides a level of protection that does not rely on host-based protections that can be accidentally misconfigured, such ...Rule Medium Severity -
The WebSphere Liberty Server must prohibit or restrict the use of nonsecure ports, protocols, modules, and/or services as defined in the PPSM CAL and vulnerability assessments.
Some networking protocols may not meet organizational security requirements to protect data and components. Application servers natively host a number of various features, such as management inter...Rule Medium Severity -
Multifactor authentication for network access to privileged accounts must be used.
Multifactor authentication creates a layered defense and makes it more difficult for an unauthorized person to access the application server. If one factor is compromised or broken, the attacker st...Rule High Severity -
The WebSphere Liberty Server must store only encrypted representations of user passwords.
WebSphere Liberty can either provide a local account store or integrate with enterprise account stores such as LDAP directories. If the application server stores application passwords in the server...Rule High Severity -
The WebSphere Liberty Server must use FIPS 140-2 approved encryption modules when authenticating users and processes.
Application servers must use and meet requirements of the DoD Enterprise PKI infrastructure for application authentication. Encryption is only as good as the encryption modules used. Unapproved cry...Rule High Severity -
HTTP session timeout must be configured.
An attacker can take advantage of user sessions that are left open, thus bypassing the user authentication process. To thwart the vulnerability of open and unused user sessions, the application se...Rule Medium Severity -
Application security must be enabled on the WebSphere Liberty Server.
Application security enables security for the applications in the environment. This type of security provides application isolation and requirements for authenticating application users. When a use...Rule High Severity -
The server.xml file must be protected from unauthorized modification.
When dealing with access restrictions pertaining to change control, it should be noted that any changes to the software, and/or application server configuration could potentially have significant a...Rule Medium Severity -
The WebSphere Liberty Server must prohibit the use of cached authenticators after an organization-defined time period.
Larger authentication cache timeout values can increase security risks. For example, a user who is revoked can still log in by using a credential that is cached in the authentication cache until th...Rule Medium Severity -
SRG-APP-000014-AS-000009
Group -
SRG-APP-000015-AS-000010
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.