Skip to content
ATO Pathways
  Log In

III - Administrative Classified

Rules and Groups employed by this XCCDF Profile

  • SRG-APP-000380

    <GroupDescription></GroupDescription>
    Group
    Show

  • The web server application, libraries, and configuration files must only be accessible to privileged users.

    &lt;VulnDiscussion&gt;A web server can be modified through parameter modification, patch installation, upgrades to the web server or modules, and s...
    Rule Medium Severity
    Show

  • SRG-APP-000383

    <GroupDescription></GroupDescription>
    Group
    Show

  • The web server must prohibit or restrict the use of nonsecure or unnecessary ports, protocols, modules, and/or services.

    &lt;VulnDiscussion&gt;Web servers provide numerous processes, features, and functionalities that utilize TCP/IP ports. Some of these processes may ...
    Rule Medium Severity
    Show

  • SRG-APP-000427

    <GroupDescription></GroupDescription>
    Group
    Show

  • The web server must only accept client certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).

    &lt;VulnDiscussion&gt;Non-DoD approved PKIs have not been evaluated to ensure that they have security controls and identity vetting procedures in p...
    Rule Medium Severity
    Show

  • SRG-APP-000429

    <GroupDescription></GroupDescription>
    Group
    Show

  • The web server must encrypt user identifiers and passwords.

    &lt;VulnDiscussion&gt;When data is written to digital media, such as hard drives, mobile computers, external/removable hard drives, personal digita...
    Rule Medium Severity
    Show

  • SRG-APP-000435

    <GroupDescription></GroupDescription>
    Group
    Show

  • The web server must be protected from being stopped by a non-privileged user.

    &lt;VulnDiscussion&gt;An attacker has at least two reasons to stop a web server. The first is to cause a DoS, and the second is to put in place cha...
    Rule Medium Severity
    Show

  • SRG-APP-000435

    <GroupDescription></GroupDescription>
    Group
    Show

  • The web server must be tuned to handle the operational requirements of the hosted application.

    &lt;VulnDiscussion&gt;A Denial of Service (DoS) can occur when the web server is so overwhelmed that it can no longer respond to additional request...
    Rule Medium Severity
    Show

  • SRG-APP-000439

    <GroupDescription></GroupDescription>
    Group
    Show

  • The web server must employ cryptographic mechanisms (TLS/DTLS/SSL) preventing the unauthorized disclosure of information during transmission.

    &lt;VulnDiscussion&gt;Preventing the disclosure of transmitted information requires that the web server take measures to employ some form of crypto...
    Rule High Severity
    Show

  • SRG-APP-000439

    <GroupDescription></GroupDescription>
    Group
    Show

  • Web server session IDs must be sent to the client using SSL/TLS.

    &lt;VulnDiscussion&gt;The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a p...
    Rule Medium Severity
    Show

  • SRG-APP-000439

    <GroupDescription></GroupDescription>
    Group
    Show

  • Web server cookies, such as session cookies, sent to the client using SSL/TLS must not be compressed.

    &lt;VulnDiscussion&gt;A cookie is used when a web server needs to share data with the client's browser. The data is often used to remember the clie...
    Rule Medium Severity
    Show

  • SRG-APP-000439

    <GroupDescription></GroupDescription>
    Group
    Show

  • Cookies exchanged between the web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data.

    &lt;VulnDiscussion&gt;A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies to be read ...
    Rule Medium Severity
    Show

  • SRG-APP-000439

    <GroupDescription></GroupDescription>
    Group
    Show

  • Cookies exchanged between the web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies.

    &lt;VulnDiscussion&gt;Cookies can be sent to a client using TLS/SSL to encrypt the cookies, but TLS/SSL is not used by every hosted application sin...
    Rule Medium Severity
    Show

  • SRG-APP-000439

    <GroupDescription></GroupDescription>
    Group
    Show

  • A web server must maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.

    &lt;VulnDiscussion&gt;Transport Layer Security (TLS) is a required transmission protocol for a web server hosting controlled information. The use o...
    Rule Medium Severity
    Show

  • SRG-APP-000439

    <GroupDescription></GroupDescription>
    Group
    Show

  • The web server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.

    &lt;VulnDiscussion&gt;During the initial setup of a Transport Layer Security (TLS) connection to the web server, the client sends a list of support...
    Rule Medium Severity
    Show

  • SRG-APP-000441

    <GroupDescription></GroupDescription>
    Group
    Show

  • The web server must maintain the confidentiality and integrity of information during preparation for transmission.

    &lt;VulnDiscussion&gt;Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including...
    Rule Medium Severity
    Show

  • SRG-APP-000442

    <GroupDescription></GroupDescription>
    Group
    Show

  • The web server must maintain the confidentiality and integrity of information during reception.

    &lt;VulnDiscussion&gt;Information can be either unintentionally or maliciously disclosed or modified during reception, including, for example, duri...
    Rule Medium Severity
    Show

  • SRG-APP-000456

    <GroupDescription></GroupDescription>
    Group
    Show

  • The web server must install security-relevant software updates within the configured time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).

    &lt;VulnDiscussion&gt;Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products t...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • All accounts installed with the web server software and tools must have passwords assigned and default passwords changed.

    &lt;VulnDiscussion&gt;During installation of the web server software, accounts are created for the web server to operate properly. The accounts ins...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    <GroupDescription></GroupDescription>
    Group
    Show

  • The web server must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.

    &lt;VulnDiscussion&gt;Configuring the web server to implement organization-wide security implementation guides and security checklists guarantees c...
    Rule Medium Severity
    Show

  • SRG-APP-000416

    <GroupDescription></GroupDescription>
    Group
    Show

  • The web server must implement required cryptographic protections using cryptographic modules complying with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when encrypting data that must be compartmentalized.

    &lt;VulnDiscussion&gt;Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. Use of weak or untested e...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules