I - Mission Critical Sensitive
Rules and Groups employed by this XCCDF Profile
-
SRG-APP-000224
Group -
The web server must generate a session ID long enough that it cannot be guessed through brute force.
Generating a session identifier (ID) that is not easily guessed through brute force is essential to deter several types of session attacks. By knowing the session ID, an attacker can hijack a user...Rule Medium Severity -
SRG-APP-000224
Group -
The web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force.
Generating a session identifier (ID) that is not easily guessed through brute force is essential to deter several types of session attacks. By knowing the session ID, an attacker can hijack a user ...Rule Medium Severity -
SRG-APP-000224
Group -
The web server must generate unique session identifiers with definable entropy.
Generating a session identifier (ID) that is not easily guessed through brute force is essential to deter several types of session attacks. By knowing the session ID, an attacker can hijack a user ...Rule Medium Severity -
SRG-APP-000225
Group -
The web server must augment re-creation to a stable and known baseline.
Making certain that the web server has not been updated by an unauthorized user is always a concern. Adding patches, functions, and modules that are untested and not part of the baseline opens the ...Rule Medium Severity -
SRG-APP-000225
Group -
The web server must be built to fail to a known safe state if system initialization fails, shutdown fails, or aborts fail.
Determining a safe state for failure and weighing that against a potential DoS for users depends on what type of application the web server is hosting. For an application presenting publicly availa...Rule Medium Severity -
SRG-APP-000225
Group -
The web server must provide a clustering capability.
The web server may host applications that display information that cannot be disrupted, such as information that is time-critical or life-threatening. In these cases, a web server that shuts down o...Rule Medium Severity -
SRG-APP-000231
Group -
Information at rest must be encrypted using a DoD-accepted algorithm to protect the confidentiality and integrity of the information.
Data at rest is inactive data which is stored physically in any digital form (e.g., databases, data warehouses, spreadsheets, archives, tapes, off-site backups, mobile devices, etc.). Data at rest ...Rule Medium Severity -
SRG-APP-000233
Group -
The web server document directory must be in a separate partition from the web servers system files.
A web server is used to deliver content on the request of a client. The content delivered to a client must be controlled, allowing only hosted application files to be accessed and delivered. To all...Rule Medium Severity -
SRG-APP-000246
Group -
The web server must restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks.
A web server can limit the ability of the web server being used in a DoS attack through several methods. The methods employed will depend upon the hosted applications and their resource needs for p...Rule Medium Severity -
SRG-APP-000251
Group -
The web server must limit the character set used for data entry.
Invalid user input occurs when a user inserts data or characters into a hosted application's data entry field and the hosted application is unprepared to process that data. This results in unantici...Rule Medium Severity -
SRG-APP-000266
Group -
The web server must display a default hosted application web page, not a directory listing, when a requested web page cannot be found.
The goal is to completely control the web user's experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an i...Rule Medium Severity -
SRG-APP-000266
Group -
Warning and error messages displayed to clients must be modified to minimize the identity of the web server, patches, loaded modules, and directory paths.
Information needed by an attacker to begin looking for possible vulnerabilities in a web server includes any information about the web server, backend systems being accessed, and plug-ins or module...Rule Medium Severity -
SRG-APP-000266
Group -
Debugging and trace information used to diagnose the web server must be disabled.
Information needed by an attacker to begin looking for possible vulnerabilities in a web server includes any information about the web server and plug-ins or modules being used. When debugging or t...Rule Medium Severity -
SRG-APP-000295
Group -
The web server must set an absolute session timeout value of eight hours or less.
Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By cl...Rule Medium Severity -
SRG-APP-000295
Group -
The web server must set an inactive timeout for sessions.
Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By cl...Rule Medium Severity -
SRG-APP-000315
Group -
Remote access to the web server must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements.
Remote access to the web server is any access that communicates through an external, non-organization-controlled network. Remote access can be used to access hosted applications or to perform manag...Rule Medium Severity -
SRG-APP-000315
Group -
The web server must restrict inbound connections from nonsecure zones.
Remote access to the web server is any access that communicates through an external, non-organization-controlled network. Remote access can be used to access hosted applications or to perform manag...Rule Medium Severity -
SRG-APP-000316
Group -
The web server must provide the capability to immediately disconnect or disable remote access to the hosted applications.
During an attack on the web server or any of the hosted applications, the system administrator may need to disconnect or disable access by users to stop the attack. The web server must provide a ...Rule Medium Severity -
SRG-APP-000340
Group -
Non-privileged accounts on the hosting system must only access web server security-relevant information and functions through a distinct administrative account.
By separating web server security functions from non-privileged users, roles can be developed that can then be used to administer the web server. Forcing users to change from a non-privileged accou...Rule Medium Severity -
SRG-APP-000357
Group -
The web server must use a logging mechanism that is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the web server.
In order to make certain that the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism needs to be able to allocate log record ...Rule Medium Severity -
SRG-APP-000358
Group -
The web server must not impede the ability to write specified log record content to an audit log server.
Writing events to a centralized management audit system offers many benefits to the enterprise over having dispersed logs. Centralized management of audit records and logs provides for efficiency i...Rule Medium Severity -
SRG-APP-000358
Group -
The web server must be configurable to integrate with an organizations security infrastructure.
A web server will typically utilize logging mechanisms for maintaining a historical log of activity that occurs within a hosted application. This information can then be used for diagnostic purpose...Rule Medium Severity -
SRG-APP-000359
Group -
The web server must use a logging mechanism that is configured to provide a warning to the ISSO and SA when allocated record storage volume reaches 75% of maximum log record storage capacity.
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process logs as required. Log processing failures include: software/hardware errors, failures in the lo...Rule Medium Severity -
SRG-APP-000374
Group -
The web server must generate log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis across multiple devices and log records. Time stamps generated by th...Rule Medium Severity -
SRG-APP-000375
Group -
The web server must record time stamps for log records to a minimum granularity of one second.
Without sufficient granularity of time stamps, it is not possible to adequately determine the chronological order of records. Time stamps generated by the web server include date and time and mus...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.