I - Mission Critical Classified
Rules and Groups employed by this XCCDF Profile
-
SRG-APP-000121
Group -
The application server must protect log tools from unauthorized access.
Protecting log data also includes identifying and protecting the tools used to view and manipulate log data. Depending upon the log format and application, system and application log tools may pr...Rule Medium Severity -
SRG-APP-000122
Group -
The application server must protect log tools from unauthorized modification.
Protecting log data also includes identifying and protecting the tools used to view and manipulate log data. Depending upon the log format and application, system and application log tools may pr...Rule Medium Severity -
SRG-APP-000123
Group -
The application server must protect log tools from unauthorized deletion.
Protecting log data also includes identifying and protecting the tools used to view and manipulate log data. Depending upon the log format and application, system and application log tools may pr...Rule Medium Severity -
SRG-APP-000125
Group -
The application server must back up log records at least every seven days onto a different system or system component than the system or component being logged.
Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up log records to a different system or onto separate media from the system the application server is ...Rule Medium Severity -
SRG-APP-000126
Group -
The application server must use cryptographic mechanisms to protect the integrity of log information.
Protecting the integrity of log records helps to ensure log files are not tampered with. Cryptographic mechanisms are the industry-established standard used to protect the integrity of log data. An...Rule Medium Severity -
SRG-APP-000131
Group -
The application server must prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate recognized and approved by the organization.
Changes to any software components can have significant effects on the overall security of the application. Verifying software components have been digitally signed using a certificate recognized a...Rule Medium Severity -
SRG-APP-000133
Group -
The application server must limit privileges to change the software resident within software libraries.
Application servers have the ability to specify that the hosted applications utilize shared libraries. The application server must have a capability to divide roles based upon duties wherein one pr...Rule Medium Severity -
SRG-APP-000133
Group -
The application server must be capable of reverting to the last known good configuration in the event of failed installations and upgrades.
Any changes to the components of the application server can have significant effects on the overall security of the system. In order to ensure a prompt response to failed application installations...Rule Medium Severity -
SRG-APP-000141
Group -
The application server must adhere to the principles of least functionality by providing only essential capabilities.
Application servers provide a myriad of differing processes, features and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoD system....Rule Medium Severity -
SRG-APP-000142
Group -
The application server must prohibit or restrict the use of nonsecure ports, protocols, modules, and/or services as defined in the PPSM CAL and vulnerability assessments.
Some networking protocols may not meet organizational security requirements to protect data and components. Application servers natively host a number of various features, such as management inter...Rule Medium Severity -
SRG-APP-000148
Group -
The application server must use an approved DOD enterprise identity, credential, and access management (ICAM) solution to uniquely identify and authenticate users (or processes acting on behalf of organizational users).
To ensure accountability and prevent unauthorized access, application server users must be uniquely identified and authenticated. This is typically accomplished via the use of a user store, which i...Rule Medium Severity -
SRG-APP-000149
Group -
The application server must use multifactor authentication for network access to privileged accounts.
Multifactor authentication creates a layered defense and makes it more difficult for an unauthorized person to access the application server. If one factor is compromised or broken, the attacker s...Rule High Severity -
SRG-APP-000151
Group -
The application server must use multifactor authentication for local access to privileged accounts.
Multifactor authentication creates a layered defense and makes it more difficult for an unauthorized person to access the application server. If one factor is compromised or broken, the attacker st...Rule High Severity -
SRG-APP-000153
Group -
The application server must authenticate users individually prior to using a group authenticator.
To ensure individual accountability and prevent unauthorized access, application server users (and any processes acting on behalf of application server users) must be individually identified and au...Rule Medium Severity -
SRG-APP-000156
Group -
The application server must provide security extensions to extend the SOAP protocol and provide secure authentication when accessing sensitive data.
Application servers may provide a web services capability that could be leveraged to allow remote access to sensitive application data. A web service, which is a repeatable process used to make dat...Rule Medium Severity -
SRG-APP-000163
Group -
The application server must disable identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
Inactive identifiers pose a risk to systems and applications. Attackers that are able to exploit an inactive identifier can potentially obtain and maintain undetected access to the application. Own...Rule Medium Severity -
SRG-APP-000171
Group -
The application server must for password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.
Applications must enforce password encryption when storing passwords. Passwords need to be protected at all times and encryption is the standard method for protecting passwords. If passwords are no...Rule Medium Severity -
SRG-APP-000172
Group -
The application server must transmit only encrypted representations of passwords.
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. If passwords are not encrypted, they can be plainly read (i.e., cle...Rule Medium Severity -
SRG-APP-000172
Group -
The application server must utilize encryption when using LDAP for authentication.
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. Application servers have the capability to utilize LDAP directorie...Rule Medium Severity -
SRG-APP-000175
Group -
The application server must perform RFC 5280-compliant certification path validation.
A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to mak...Rule Medium Severity -
SRG-APP-000176
Group -
Only authenticated system administrators or the designated PKI Sponsor for the application server must have access to the web servers private key.
The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiati...Rule Medium Severity -
SRG-APP-000177
Group -
The application server must map the authenticated identity to the individual user or group account for PKI-based authentication.
The cornerstone of PKI is the private key used to encrypt or digitally sign information. The key by itself is a cryptographic value that does not contain specific user information, but the key can ...Rule Medium Severity -
SRG-APP-000178
Group -
The application server must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
To prevent the compromise of authentication information during the authentication process, the application server authentication screens must obfuscate input so an unauthorized user cannot view a p...Rule Medium Severity -
SRG-APP-000179
Group -
The application server must utilize FIPS 140-2 approved encryption modules when authenticating users and processes.
Encryption is only as good as the encryption modules utilized. Unapproved cryptographic module algorithms cannot be verified and cannot be relied upon to provide confidentiality or integrity, and ...Rule High Severity -
SRG-APP-000181
Group -
The application server must provide a log reduction capability that supports on-demand reporting requirements.
The ability to generate on-demand reports, including after the log data has been subjected to log reduction, greatly facilitates the organization's ability to generate incident reports as needed to...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.