The application must reveal error messages only to authorized individuals (ISSO, ISSM, and SA).
An XCCDF Rule
Description
<VulnDiscussion>Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state. Additionally, sensitive account information must not be revealed through error messages to unauthorized personnel or their designated representatives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-77485r1_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Configure RiOS to reveal error messages only to authorized individuals (ISSO, ISSM, and SA).
Navigate to the device Management Console
Navigate to Configure >> Security >> User Permissions
Select the user name that needs to have modified permissions