The application must restrict the ability to launch Denial of Service (DoS) attacks against itself or other information systems.
An XCCDF Rule
Description
<VulnDiscussion>Denial of Service (DoS) is a condition where a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. Individuals of concern can include hostile insiders or external adversaries that have access or have successfully breached the information system and are using the system as a platform to launch cyber attacks on the application, the application host or other third-parties. Application developers and application administrators must take the steps needed to ensure an application cannot be used to launch DoS attacks against the application itself, the application host or other systems and networks. Application developers should be cognizant that many attackers using DoS techniques will attempt to identify resource intensive processes and functions within the application. For web applications, this can be application objects that perform database queries or other resource intensive tasks. Improper application memory management can also lead to memory leaks which can exhaust system resources forcing a system or application restart. Limiting attempts to repeatedly execute application processes by validating the requests also reduces the ability to launch some DoS attacks. For application administrators, ensuring network access controls are in place to protect the application host. The methods employed to counter DoS risks are dependent upon the application layer methods that can be used to exploit it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-222594r879650_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Design and deploy the application to utilize controls that will prevent the application from being affected by DoS attacks or being used to attack other systems. This includes but is not limited to utilizing throttling techniques for application traffic such as QoS or implementing logic controls within the application code itself that prevents application use that results in network or system capabilities being exceeded.