DISA STIG library V6R5
| Ref | Title | Text | |
|---|---|---|---|
| APSC-DV-000010 | The application must provide a capability to limit the number of logon sessions per user. | For production environments; Review the system documentation, identify the number of application user logon sessions allowed per user, identify the methods utilized for user session management or have application administrator describe how | |
| APSC-DV-000060 | The application must clear temporary storage and cookies when the session is terminated. | Review application design documentation and interview application administrator to identify how the application makes use of temporary client storage and cookies. Identify cookie and web storage locations on the client. Clear all browser co | |
| APSC-DV-000070 | The application must automatically terminate the non-privileged user session and log off non-privileged users after a 15 minute idle time period has elapsed. | Ask the application representative to demonstrate the configuration setting where the idle time out value is defined. Alternatively, logon with a regular application user account and let the session sit idle for 15 minutes. Attempt to acces | |
| APSC-DV-000080 | The application must automatically terminate the admin user session and log off admin users after a 10 minute idle time period is exceeded. | Ask the application representative to demonstrate the application configuration setting where the idle time out value is defined for admin users. Alternatively, logon with an admin user account and let the session sit idle for 10 minutes. A | |
| APSC-DV-000090 | Applications requiring user access authentication must provide a logoff capability for user initiated communication session. | If the application does not provide an interface for interactive user access, this is not applicable. Log on to the application with a valid user account. Examine the user interface. Identify the command or link that provides the logoff fun | |
| APSC-DV-000100 | The application must display an explicit logoff message to users indicating the reliable termination of authenticated communications sessions. | If the application does not provide an interface for interactive user access, this is not applicable. Log on to the application with a valid user account. Examine the user interface. Identify the command or link that provides the logoff fun | |
| APSC-DV-000110 | The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in storage. | Review the application documentation and interview the application administrator. Determine if the application processes classified, CUI, or other data that is required to be marked and identify if the application requirements specify data | |
| APSC-DV-000120 | The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in process. | Review the application documentation and interview the application administrator. Identify if the application requirements include data marking. Also determine if the application processes classified, CUI, or other data that is required to | |
| APSC-DV-000130 | The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission. | Review the application documentation and interview the application administrator. Identify if the application requirements include data marking. Also determine if the application processes classified, CUI, or other data that is required to | |
| APSC-DV-000160 | The application must implement DoW-approved encryption to protect the confidentiality of remote access sessions. | Review the application documentation and interview the system administrator. Identify the application encryption capabilities and methods for implementing encryption protection. For web based applications; open the web browser and access th | |
| APSC-DV-000170 | The application must implement cryptographic mechanisms to protect the integrity of remote access sessions. | Review the application documentation and interview the system administrator. Identify the application encryption capabilities and methods for implementing encryption protection. For web based applications; open the web browser and access th | |
| APSC-DV-000180 | Applications with SOAP messages requiring integrity must include the following message elements:-Message ID-Service Request-Timestamp-SAML Assertion (optionally included in messages) and all elements of the message must be digitally signed. | Review the application documentation, system security plan, application architecture diagrams and interview the application administrator. Review the design document for web services using SOAP messages. If the application does not utilize | |
| APSC-DV-000190 | Messages protected with WS_Security must use time stamps with creation and expiration times. | Ask the application representative for the design document. Review the design document for web services using WS-Security tokens. If the application does not utilize WS-Security tokens, this check is not applicable. Examine the contents of | |
| APSC-DV-000200 | Validity periods must be verified on all application messages using WS-Security or SAML assertions. | Ask the application representative for the design document. Review the design document for web services. If the application does not utilize WSS or SAML assertions, this requirement is not applicable. Review the design document and verify v | |
| APSC-DV-000210 | The application must ensure each unique asserting party provides unique assertion ID references for each SAML assertion. | Ask the application representative for the design document. Review the design document for web services using SAML assertions. If the application does not utilize SAML assertions, this check is not applicable. Review the design document and | |
| APSC-DV-000220 | The application must ensure encrypted assertions, or equivalent confidentiality protections are used when assertion data is passed through an intermediary, and confidentiality of the assertion data is required when passing through the intermediary. | Ask the application representative for the design document. Review the design document for web services using WS-Security tokens. If the application does not utilize WS-Security tokens, this check is not applicable. Verify all WS-Security t | |
| APSC-DV-000230 | The application must use the NotOnOrAfter condition when using the SubjectConfirmation element in a SAML assertion. | Ask the application representative for the design document. Review the design document for web services using SAML assertions. If the application does not utilize SAML assertions, this check is not applicable. Examine the contents of a SOAP | |
| APSC-DV-000240 | The application must use both the NotBefore and NotOnOrAfter elements or OneTimeUse element when using the Conditions element in a SAML assertion. | Ask the application representative for the design document. Review the design document for web services using SAML assertions. If the application does not utilize SAML assertions, this check is not applicable. Examine the contents of a SOAP | |
| APSC-DV-000250 | The application must ensure if a OneTimeUse element is used in an assertion, there is only one of the same used in the Conditions element portion of an assertion. | Ask the application representative for the design document. Review the design document for web services using SAML assertions. If the application does not utilize SAML assertions, this check is not applicable. Examine the contents of a SOAP | |
| APSC-DV-000260 | The application must ensure messages are encrypted when the SessionIndex is tied to privacy data. | Ask the application representative for the design document. Review the design document for web services using SAML assertions. If the application does not utilize SAML assertions, this check is not applicable. Examine the contents of a SOAP | |
| APSC-DV-000280 | The application must provide automated mechanisms for supporting account management functions. | Review the application documentation and interview the application administrator. Identify the account management methods, processes and procedures that are used. If the application is utilizing a centralized authentication mechanism such a | |
| APSC-DV-000290 | Shared/group account credentials must be terminated when members leave the group. | Review the application documentation and determine if there is a requirement for shared or group accounts. If there is no official requirement for shared or group application accounts, this requirement is Not Applicable. Interview the appli | |
| APSC-DV-000300 | The application must automatically remove or disable temporary user accounts 72 hours after account creation. | If official documentation exist that disallows the use of temporary user accounts within the application, this requirement is not applicable. Examine the application documentation or interview the application representative to identify how | |
| APSC-DV-000310 | The application must have a process, feature or function that prevents removal or disabling of emergency accounts. | Review the application documentation and interview the application administrator. Identify if emergency accounts are ever used. If emergency accounts are not used, this requirement is not applicable. If emergency accounts are used, validate | |
| APSC-DV-000320 | The application must automatically disable accounts after a 35 day period of account inactivity. | Examine the application documentation or interview the application representative to identify how the application users are managed. Interview the application administrator and determine if the application is configured to utilize a central | |
| APSC-DV-000330 | Unnecessary application accounts must be disabled, or deleted. | Review the system documentation and identify any valid application accounts that are required in order for the application to operate. Accounts the application itself uses in order to function are not in scope for this requirement. Have the | |
| APSC-DV-000340 | The application must automatically audit account creation. | Examine the application documentation to identify how the application users are managed. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Dire | |
| APSC-DV-000350 | The application must automatically audit account modification. | Examine the application documentation to identify how the application users are managed. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Dire | |
| APSC-DV-000360 | The application must automatically audit account disabling actions. | Examine the application documentation to identify how the application users are managed. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Dire | |
| APSC-DV-000370 | The application must automatically audit account removal actions. | Examine the application documentation to identify how the application users are managed. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Dire | |
| APSC-DV-000380 | The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are created. | Review the application and system documentation. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the appl | |
| APSC-DV-000390 | The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are modified. | Review the application and system documentation. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the appl | |
| APSC-DV-000400 | The application must notify system administrators (SAs) and information system security officers (ISSOs) of account disabling actions. | Review the application and system documentation. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the appl | |
| APSC-DV-000410 | The application must notify system administrators (SAs) and information system security officers (ISSOs) of account removal actions. | Review the application and system documentation. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the appl | |
| APSC-DV-000420 | The application must automatically audit account enabling actions. | Examine the application documentation or interview the application representative to identify how the application users are managed. Interview the application administrator and determine if the application is configured to utilize a central | |
| APSC-DV-000430 | The application must notify system administrators (SAs) and information system security officers (ISSOs) of account enabling actions. | Review the application and system documentation. Interview application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the applicat | |
| APSC-DV-000440 | Application data protection requirements must be identified and documented. | Ask the application representative for the documentation that identifies the application data elements, the protection requirements, and any associated steps that are being taken to protect the data. If the application data protection requi | |
| APSC-DV-000450 | The application must utilize organization-defined data mining detection techniques for organization-defined data storage objects to adequately detect data mining attempts. | Review the security plan, application and system documentation and interview the application administrator to identify data mining protections that are required of the application. If there are no data mining protections required, this requ | |
| APSC-DV-000460 | The application must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. | Review the application documentation and interview the application administrator. Review application data protection requirements. Identify application resources that require protection and authentication over and above the authentication r | |
| APSC-DV-000470 | The application must enforce organization-defined discretionary access control policies over defined subjects and objects. | Review the application documentation and interview the application administrator. Review application data protection requirements and application integrated access control methods. Identify if the application implements discretionary access | |
| APSC-DV-000480 | The application must enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies. | Review the application documentation and interview the application and system administrators. Review application features and functions to determine if the application is designed to control the flow of information within the system. Identi | |
| APSC-DV-000490 | The application must enforce approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies. | Review the application documentation and interview the application and system administrators. Identify application features and functions to determine if the application is designed to control the flow of information between interconnected | |
| APSC-DV-000500 | The application must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. | Identify the application user account(s) that the application uses to run. These accounts include the application processes (defined by Control Panel Services (Windows) or ps –ef (UNIX)) or for an n-tier application, the account that connec | |
| APSC-DV-000510 | The application must execute without excessive account permissions. | Review the system documentation or interview the application representative and identify if the application utilizes an account in order to operate. Determine the OS user groups in which each application account is a member. List the user r | |
| APSC-DV-000520 | The application must audit the execution of privileged functions. | Log on to the application as an administrative user. Identify functionality within the application that requires utilizing the admin role. Monitor application logs while performing privileged functions within the application. Perform admini | |
| APSC-DV-000530 | The application must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period. | All testing must be performed within a 15-minute window. Log on to the application with a test user account. Intentionally enter an incorrect user password or pin. Repeat 2 times within 15 minutes for a total of three failed attempts. Notif | |
| APSC-DV-000540 | The application administrator must follow an approved process to unlock locked user accounts. | Interview the application administrator and identify the approved process for unlocking user accounts. The process may involve a manual or automated reset after the locked out user has identified themselves using standard user identificatio | |
| APSC-DV-000550 | The application must display the Standard Mandatory DoW Notice and Consent Banner before granting access to the application. | If the application has no interactive user interface, this requirement is not applicable. Log on to the application as a user. Observe the screen and ensure the DoW-approved banner is displayed prior to obtaining access to the application. | |
| APSC-DV-000560 | The application must retain the Standard Mandatory DoW Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access. | If the application has no interactive user interface, this requirement is not applicable. If the user interface is only available via the OS console, e.g., a fat client application installed on a GFE desktop or laptop, and that GFE is confi | |
| APSC-DV-000570 | The publicly accessible application must display the Standard Mandatory DoW Notice and Consent Banner before granting access to the application. | This requirement only applies to publicly accessible applications. If the application is not publicly accessible, this requirement is not applicable. Access the application and observe the screen to ensure the DoW-approved banner is display | |
| APSC-DV-000580 | The application must display the time and date of the users last successful logon. | Review the application documentation and interview the application administrator. If the application does not provide a user interface, this requirement is not applicable. Logon to the application as a test user and verify successful authen | |
| APSC-DV-000590 | The application must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation. | Review the application documentation, the design requirements if available and interview the application administrator. Identify application services or application commands that are formerly required and designed to provide non-repudiation | |
| APSC-DV-000600 | For applications providing audit record aggregation, the application must compile audit records from organization-defined information system components into a system-wide audit trail that is time-correlated with an organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail. | Review the application documentation and interview the application administrator. Determine if the application has the ability to compile audit records from multiple systems or system components. If the application does not provide log aggr | |
| APSC-DV-000620 | The application must provide audit record generation capability for the creation of session IDs. | Access the management interface for the application or configuration file and evaluate the log/audit management settings. Determine if the setting that enables session ID creation event auditing is activated. Create a new user session by lo | |
| APSC-DV-000630 | The application must provide audit record generation capability for the destruction of session IDs. | Access the management interface for the application or configuration file and evaluate the log/audit management settings. Determine if the setting that enables session ID destruction event auditing is activated. Terminate a user session wit | |
| APSC-DV-000640 | The application must provide audit record generation capability for the renewal of session IDs. | Interview the system admin and review the application documentation. Identify any web pages or application functionality where a user's privileges or permissions will change. This is most likely to occur during the authentication stages. Ev | |
| APSC-DV-000650 | The application must not write sensitive data into the application logs. | Review the application logs and identify application logging format. Using the format of the log and the requisite search data as a guide to create your search, create search strings that could successfully identify the existence of passwor | |
| APSC-DV-000660 | The application must provide audit record generation capability for session timeouts. | Review the application documentation and interview the application administrator to identify log locations for application session activity. Open the log file that tracks user session activity. Access the application as a regular user and i | |
| APSC-DV-000670 | The application must record a time stamp indicating when the event occurred. | Review the application logs. If the time the event occurred is not included as part of the event, this is a finding. | |
| APSC-DV-000680 | The application must provide audit record generation capability for HTTP headers including User-Agent, Referer, GET, and POST. | Review the application documentation and interview the application administrator to identify log locations for application session activity. Open the log file that tracks user session activity. Access the application as a regular user and i | |
| APSC-DV-000690 | The application must provide audit record generation capability for connecting system IP addresses. | Review the application documentation and interview the application administrator to identify where audit logs are stored. Review audit logs and determine if the IP address information of systems that connect to the application is kept in th | |
| APSC-DV-000700 | The application must record the username or user ID of the user associated with the event. | Review and monitor the application logs. Connect to the application and perform application activity that is allowed by the user such as accessing data or running reports. Observe if the log includes an entry to indicate the user ID of the | |
| APSC-DV-000710 | The application must generate audit records when successful/unsuccessful attempts to grant privileges occur. | Review the application documentation and interview the application admin to identify application management interfaces and features. Access the application management utility and create a test user account or use the account of a regular un | |
| APSC-DV-000720 | The application must generate audit records when successful/unsuccessful attempts to access security objects occur. | Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify application functionality that provides privilege or permission settings to security objects within t | |
| APSC-DV-000730 | The application must generate audit records when successful/unsuccessful attempts to access security levels occur. | Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify application functionality that provides privilege escalation or access to additional security levels | |
| APSC-DV-000740 | The application must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur. | Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify any data protections that are required. Identify any categories of data or classification of data. If | |
| APSC-DV-000750 | The application must generate audit records when successful/unsuccessful attempts to modify privileges occur. | Review the application documentation and interview the application admin to identify application management interfaces and features. Access the application management utility and create a test user account or use the account of a regular pr | |
| APSC-DV-000760 | The application must generate audit records when successful/unsuccessful attempts to modify security objects occur. | Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify application functionality that provides privilege or permission settings to security objects within t | |
| APSC-DV-000770 | The application must generate audit records when successful/unsuccessful attempts to modify security levels occur. | Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify application functionality that provides privilege escalation or access to additional security levels | |
| APSC-DV-000780 | The application must generate audit records when successful/unsuccessful attempts to modify categories of information (e.g., classification levels) occur. | Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify any data protections that are required. Identify any categories of data or classification of data. If | |
| APSC-DV-000790 | The application must generate audit records when successful/unsuccessful attempts to delete privileges occur. | Review the application documentation and interview the application admin to identify application management interfaces and features. Access the application management utility and create a test user account or use the account of a regular pr | |
| APSC-DV-000800 | The application must generate audit records when successful/unsuccessful attempts to delete security levels occur. | Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify application functionality that provides privilege escalation or access to additional security levels | |
| APSC-DV-000810 | The application must generate audit records when successful/unsuccessful attempts to delete application database security objects occur. | Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify application functionality that provides privilege or permission settings to database security objects | |
| APSC-DV-000820 | The application must generate audit records when successful/unsuccessful attempts to delete categories of information (e.g., classification levels) occur. | Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify any data protections that are required. Identify any categories of data or classification of data. If | |
| APSC-DV-000830 | The application must generate audit records when successful/unsuccessful logon attempts occur. | Review and monitor the application logs. Authenticate to the application and observe if the log includes an entry to indicate the user’s authentication was successful. Terminate the user session by logging out. Reauthenticate using invalid | |
| APSC-DV-000840 | The application must generate audit records for privileged activities or other system-level access. | Review and monitor the application logs. Authenticate to the application as a privileged user and observe if the log includes an entry to indicate the user’s authentication was successful. Perform actions as an admin or other privileged use | |
| APSC-DV-000850 | The application must generate audit records showing starting and ending time for user access to the system. | Review and monitor the application logs. Initiate a user session and observe if the log includes a time stamp showing the start of the session. Terminate the user session and observe if the log includes a time stamp showing the end of the s | |
| APSC-DV-000860 | The application must generate audit records when successful/unsuccessful accesses to objects occur. | Review the application documentation and interview the application administrator to identify log locations. Access the application logs. Review the logs and identify if the application is logging both successful and unsuccessful access to a | |
| APSC-DV-000870 | The application must generate audit records for all direct access to the information system. | Review the application documentation and interview the application administrator. Identify if the application implements a direct access feature or function that allows users to directly access the underlying OS. Direct access includes but | |
| APSC-DV-000880 | The application must generate audit records for all account creations, modifications, disabling, and termination events. | Examine the application documentation or interview the application representative to identify how the application users are managed. Interview the application administrator and determine if the application is configured to utilize a central | |
| APSC-DV-000910 | The application must initiate session auditing upon startup. | Examine the application design documentation and interview the application administrator to identify application logging behavior. If the application is writing to an existing log or log file: Open and monitor the application log. Start the | |
| APSC-DV-000940 | The application must log application shutdown events. | Review and monitor the application and system logs. If an application shutdown event is not recorded in the logs, either initiate a shutdown event and review the logs after reestablishing access or request backup copies of the application o | |
| APSC-DV-000950 | The application must log destination IP addresses. | If the application design documentation indicates the application does not initiate connections to remote systems this requirement is not applicable. Network connections to systems used for support services such as DNS, AD, or LDAP may be s | |
| APSC-DV-000960 | The application must log user actions involving access to data. | Review and monitor the application logs. When accessing data, the logs are most likely database logs. If the application design documents include specific data elements that require protection, ensure user access to those data elements are | |
| APSC-DV-000970 | The application must log user actions involving changes to data. | Review and monitor the application logs. When modifying data, the logs are most likely database logs. If the application design documents include specific data elements that require protection, ensure any changes to those specific data elem | |
| APSC-DV-000980 | The application must produce audit records containing information to establish when (date and time) the events occurred. | Access the application logs and review the log entries for date and time. Each event written into the log must have a corresponding date and time stamp associated with it. If the audit logs do not have a corresponding date and time associat | |
| APSC-DV-000990 | The application must produce audit records containing enough information to establish which component, feature or function of the application triggered the audit event. | Review application administration and/or design documents. Identify key aspects of application architecture objects and components, e.g., Web Server, Application server, Database server. Interview the application administrator and identify | |
| APSC-DV-001000 | When using centralized logging; the application must include a unique identifier in order to distinguish itself from other application logs. | If the application is logging locally and does not utilize a centralized logging solution, this requirement is not applicable. Review system documentation and identify log location. Access the application logs. Review the application logs. | |
| APSC-DV-001010 | The application must produce audit records that contain information to establish the outcome of the events. | Review system and application documentation to identify application operation and function. Access the application logs and review the logs to determine if the results of application operations are logged. Successful application events are | |
| APSC-DV-001020 | The application must generate audit records containing information that establishes the identity of any individual or process associated with the event. | Review system documentation and discuss application operation with application administrator. Identify application processes and application users. Identify application components, e.g., application features framework and function. Identify | |
| APSC-DV-001030 | The application must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users. | Review application documentation and interview application administrator. Identify audit log locations and review audit logs. Access the system as a privileged user and execute privileged commands. Review the application logs and ensure tha | |
| APSC-DV-001040 | The application must implement transaction recovery logs when transaction based. | Review the application documentation and interview the application administrator. Have the application administrator provide configuration settings that demonstrate transaction logging is enabled. Review configuration settings for the locat | |
| APSC-DV-001050 | The application must provide centralized management and configuration of the content to be captured in audit records generated by all application components. | Review the application documentation and interview the application administrator to determine the logging architecture of the application. If the application is configured to log application event entries to a centralized, enterprise based | |
| APSC-DV-001070 | The application must off-load audit records onto a different system or media than the system being audited. | Review application documentation and interview application administrator. Identify log functionality and locations of log files. Obtain risk acceptance documentation and task scheduling information. If the application is configured to utili | |
| APSC-DV-001080 | The application must be configured to write application logs to a centralized log repository. | Review application documentation and interview application administrator. Evaluate application log management processes and determine if the system is configured to utilize a centralized log management system for the hosting and management | |
| APSC-DV-001090 | The application must provide an immediate warning to the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity. | Review system documentation and interview application administrator for details regarding logging configuration. If the application utilizes a centralized logging system that provides storage capacity alarming, this requirement is not appli | |
| APSC-DV-001100 | Applications categorized as having a moderate or high impact must provide an immediate real-time alert to the SA and ISSO (at a minimum) for all audit failure events. | Review system documentation and interview application administrator for details regarding application security categorization and logging configuration. If the application utilizes a centralized logging system that provides the real-time al | |
| APSC-DV-001110 | The application must alert the ISSO and SA (at a minimum) in the event of an audit processing failure. | Review system documentation and interview application administrator for details regarding logging configuration. If the application utilizes a centralized logging system that provides the audit processing failure alarms, this requirement is | |
| APSC-DV-001120 | The application must shut down by default upon audit failure (unless availability is an overriding concern). | Review system documentation and interview application administrator for details regarding logging configuration. Identify application shut down capability regarding audit processing failure events. Locate and verify application logging sett | |
| APSC-DV-001130 | The application must provide the capability to centrally review and analyze audit records from multiple components within the system. | Review system documentation and interview application administrator for details regarding application architecture and logging configuration. Identify the application components, the logs that are associated with the components and the loca | |
| APSC-DV-001140 | The application must provide the capability to filter audit records for events of interest based upon organization-defined criteria. | Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components as well as | |
| APSC-DV-001150 | The application must provide an audit reduction capability that supports on-demand reporting requirements. | Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components. If the ap | |
| APSC-DV-001160 | The application must provide an audit reduction capability that supports on-demand audit review and analysis. | Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components. If the ap | |
| APSC-DV-001170 | The application must provide an audit reduction capability that supports after-the-fact investigations of security incidents. | Review application documentation and interview application administrator for details regarding audit reduction (log record event filtering). Access the application with user rights sufficient to read and filter audit records. Navigate the a | |
| APSC-DV-001180 | The application must provide a report generation capability that supports on-demand audit review and analysis. | Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering). Access the application with user rights sufficient to read and filter audit records. Naviga | |
| APSC-DV-001190 | The application must provide a report generation capability that supports on-demand reporting requirements. | Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering). Access the application with user rights sufficient to read and filter audit records. Naviga | |
| APSC-DV-001200 | The application must provide a report generation capability that supports after-the-fact investigations of security incidents. | Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering). Access the application with user rights sufficient to read and filter audit records. Naviga | |
| APSC-DV-001210 | The application must provide an audit reduction capability that does not alter original content or time ordering of audit records. | Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering). Access the application with user rights sufficient to read and filter audit records. Naviga | |
| APSC-DV-001220 | The application must provide a report generation capability that does not alter original content or time ordering of audit records. | Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering). Access the application with user rights sufficient to read and filter audit records. Naviga | |
| APSC-DV-001250 | The applications must use internal system clocks to generate time stamps for audit records. | Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components. Ensure th | |
| APSC-DV-001260 | The application must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT). | Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components. If the ap | |
| APSC-DV-001270 | The application must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision. | Review the system documentation and interview the application administrator to determine where application audit logs are written and how time stamps are recorded. If the application utilizes the underlying OS for time stamping and time syn | |
| APSC-DV-001280 | The application must protect audit information from any type of unauthorized read access. | Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components. Identify | |
| APSC-DV-001290 | The application must protect audit information from unauthorized modification. | Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components. Identify | |
| APSC-DV-001300 | The application must protect audit information from unauthorized deletion. | Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components. Identify | |
| APSC-DV-001310 | The application must protect audit tools from unauthorized access. | Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and audit tools. Identify the application audit tools and their locations. If the application does no | |
| APSC-DV-001320 | The application must protect audit tools from unauthorized modification. | Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and provided audit tools. Identify the application audit tools and their locations. If the applicatio | |
| APSC-DV-001330 | The application must protect audit tools from unauthorized deletion. | Review the system documentation and interview the application administrator for details regarding application architecture, audit methods and provided audit tools. Identify the application audit tools and their locations. If the application | |
| APSC-DV-001340 | The application must back up audit records at least every seven days onto a different system or system component than the system or component being audited. | Review the application documentation and interview the application administrator. Identify log functionality and locations of log files. If the application does not include a built-in backup capability for backing up its own audit records, | |
| APSC-DV-001350 | The application must use cryptographic mechanisms to protect the integrity of audit information. | Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and provided audit tools. Identify the location of the application audit information. If the applicat | |
| APSC-DV-001360 | Application audit tools must be cryptographically hashed. | Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and provided audit tools. Identify the location of the application audit tools. Separate audit tools | |
| APSC-DV-001370 | The integrity of the audit tools must be validated by checking the files for changes in the cryptographic hash value. | Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and provided audit tools. Identify the location of the application audit tools. Separate audit tools | |
| APSC-DV-001390 | The application must prohibit user installation of software without explicit privileged status. | Review the application documentation and interview the application administrator to determine the capabilities of the application as it relates to software installation or product function extension. Identify any software configuration chan | |
| APSC-DV-001410 | The application must enforce access restrictions associated with changes to application configuration. | Review the application documentation and configuration settings. Access the application configuration settings interface as a regular non-privileged user. Attempt to make configuration changes to the application. If configuration changes ca | |
| APSC-DV-001420 | The application must audit who makes configuration changes to the application. | Review the application documentation and configuration settings. Access the application configuration settings interface as a privileged user. Make configuration changes to the application. Review the application audit logs and ensure a log | |
| APSC-DV-001430 | The application must have the capability to prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization. | Review the application documentation and interview the application administrator to determine the process and commands used for patching the application. Access application configuration settings. Review commands and procedures used to patc | |
| APSC-DV-001440 | The applications must limit privileges to change the software resident within software libraries. | Review the application documentation and interview the application administrator to identify the application architecture. Identify application folders where application libraries are stored. Review permissions of application folders and li | |
| APSC-DV-001460 | An application vulnerability assessment must be conducted. | Review the application documentation to understand application architecture. Interview the application administrator, obtain and review their application vulnerability scanning process. Request the latest scan results including scan configu | |
| APSC-DV-001480 | The application must prevent program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage. | Review the application documentation and interview the application administrator to determine if policies, rules, or restrictions exist regarding application usage or terms which authorize the conditions of application use. If the policy, t | |
| APSC-DV-001490 | The application must employ a deny-all, permit-by-exception (whitelist) policy to allow the execution of authorized software programs. | If the application is not a configuration management or similar type of application designed to manage system processes and configurations, this requirement is not applicable. Review the application documentation and interview the applicati | |
| APSC-DV-001500 | The application must be configured to disable non-essential capabilities. | Review the application guidance, application requirements documentation, and interview the application administrator. Identify the application's operational requirements and what services the application is intended to provide users. Review | |
| APSC-DV-001510 | The application must be configured to use only functions, ports, and protocols permitted to it in the PPSM CAL. | Review the application documentation and configuration. Interview the application administrator. Identify the network ports and protocols that are utilized by the application. Using a combination of relevant OS commands and application conf | |
| APSC-DV-001520 | The application must require users to reauthenticate when organization-defined circumstances or situations require reauthentication. | Review the application guidance and interview the application administrator. Identify the application user roles. Identify the methods and manner in which an application user is allowed to escalate their privileges or change their role. Cre | |
| APSC-DV-001530 | The application must require devices to reauthenticate when organization-defined circumstances or situations requiring reauthentication. | Review the application guidance and interview the application administrator. Identify the methods and manner in which application devices such as an XML gateway, SOA application gateway, or application firewall is allowed to access the appl | |
| APSC-DV-001540 | The application must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users). | Review the application documentation and interview the application administrator to determine how organizational users access the application. If the application is publicly available, providing access to publicly releasable data and the us | |
| APSC-DV-001550 | The application must use multifactor (Alt. Token) authentication for network access to privileged accounts. | Review the application documentation and interview the application administrator to identify application access methods. Ask the application administrator to present both their primary CAC and their Alt. Token. Ask the application administr | |
| APSC-DV-001560 | The application must accept Personal Identity Verification (PIV) credentials. | Review the application documentation and interview the application administrator to identify application access methods. If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable. As | |
| APSC-DV-001570 | The application must electronically verify Personal Identity Verification (PIV) credentials. | Review the application documentation and interview the application administrator to identify application access methods. If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable. As | |
| APSC-DV-001580 | The application must use multifactor (e.g., CAC, Alt. Token) authentication for network access to non-privileged accounts. | Review the application documentation and interview the application administrator to identify application access methods. If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable. As | |
| APSC-DV-001590 | The application must use multifactor (Alt. Token) authentication for local access to privileged accounts. | Review the application documentation and interview the application administrator to identify application access methods. Ask the application administrator to present both their primary CAC and their Alt. Token. Ask the application administr | |
| APSC-DV-001600 | The application must use multifactor (e.g., CAC, Alt. Token) authentication for local access to nonprivileged accounts. | Review the application documentation and interview the application administrator to identify application access methods. If the application is not PKI-enabled due to the hosted data being publicly releasable, this check is Not Applicable. A | |
| APSC-DV-001610 | The application must ensure users are authenticated with an individual authenticator prior to using a group authenticator. | Review the application documentation, examine user accounts and group membership, and interview the application administrator to identify group or shared accounts. Document the group or shared account information. If the application does no | |
| APSC-DV-001620 | The application must implement replay-resistant authentication mechanisms for network access to privileged accounts. | Review application documentation and interview application administrator to identify what authentication mechanisms are used when accessing the application. If the application is hosting publicly releasable information that does not require | |
| APSC-DV-001630 | The application must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts. | Review the application documentation and interview the application administrator to identify what authentication mechanisms are used when accessing the application. If the application is hosting publicly releasable information that does not | |
| APSC-DV-001640 | The application must utilize mutual authentication when endpoint device non-repudiation protections are required by DoW policy or by the data owner. | Review the application documentation and interview the application administrator. Determine if mutual authentication is mandated by the data owner or by mission data protection objectives and data type. Review application architecture and d | |
| APSC-DV-001650 | The application must authenticate all network connected endpoint devices before establishing any connection. | Review the application documentation, implementation documentation and interview the application administrator. Identify if the application utilizes Web Services/Service-Oriented Architecture (SOA). Using the web services framework that has | |
| APSC-DV-001660 | Service-Oriented Applications handling non-releasable data must authenticate endpoint devices via mutual SSL/TLS. | Review application documentation and interview application administrator. Identify application data elements and determine if the application is handling/processing non-releasable data. Review the application architecture and design documen | |
| APSC-DV-001670 | The application must disable device identifiers after 35 days of inactivity unless a cryptographic certificate is used for authentication. | Review the application documentation and interview the application administrator. If the application is not designed to authenticate devices (such as mobile phones, gateways or other smart devices), or uses DoW PKI certificates to authentic | |
| APSC-DV-001680 | The application must enforce a minimum 15-character password length. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access th | |
| APSC-DV-001690 | The application must enforce password complexity by requiring that at least one uppercase character be used. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access th | |
| APSC-DV-001700 | The application must enforce password complexity by requiring that at least one lowercase character be used. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access th | |
| APSC-DV-001710 | The application must enforce password complexity by requiring that at least one numeric character be used. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access th | |
| APSC-DV-001720 | The application must enforce password complexity by requiring that at least one special character be used. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access th | |
| APSC-DV-001730 | The application must require the change of at least eight of the total number of characters when passwords are changed. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access th | |
| APSC-DV-001740 | The application must only store cryptographic representations of passwords. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Have the | |
| APSC-DV-001750 | The application must transmit only cryptographically-protected passwords. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, the requirement is not applicable. Identify w | |
| APSC-DV-001760 | The application must enforce 24 hours/1 day as the minimum password lifetime. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access th | |
| APSC-DV-001770 | The application must enforce a 180-day maximum password lifetime restriction. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access th | |
| APSC-DV-001780 | The application must prohibit password reuse for a minimum of five generations. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access th | |
| APSC-DV-001790 | The application must allow the use of a temporary password for system logons with an immediate change to a permanent password. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access th | |
| APSC-DV-001795 | The application password must not be changeable by users other than the administrator or the user with which the password is associated. | Review the application documentation and interview application administrator. Determine if the application utilizes passwords. If the application does not utilize passwords, the requirement is NA. Identify the processes, commands or web pag | |
| APSC-DV-001800 | The application must terminate existing user sessions upon account deletion. | Review the application documentation and interview the application administrator. Identify the user management functions of the application and create a test user account. Access the application and perform application functions as the test | |
| APSC-DV-001810 | The application, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. | Review the application documentation, the application architecture and interview the application administrator to identify the method employed by the application for validating certificates. Review the method to determine if a certification | |
| APSC-DV-001820 | The application, when using PKI-based authentication, must enforce authorized access to the corresponding private key. | Review the application documentation and interview the application administrator to identify where the application's private key is stored. If the application does not perform code signing or other cryptographic tasks requiring a private ke | |
| APSC-DV-001830 | The application must map the authenticated identity to the individual user or group account for PKI-based authentication. | Review the application documentation and interview the application administrator to identify how the application maps individual user certificates or group accounts to individual users. Access the application as a regular user while reviewi | |
| APSC-DV-001840 | The application, for PKI-based authentication, must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network. | Review the application documentation and interview the system administrator to identify how the application checks certificate revocation. If the application resides on the SIPRnet and does not have access to the root CAs, this requirement | |
| APSC-DV-001850 | The application must not display passwords/PINs as clear text. | Ask the application admin to log on to the application. Observe the authentication process and verify any display feedback provided when the admin enters her/his password is obfuscated and not clear text. For applications that display authe | |
| APSC-DV-001860 | The application must use mechanisms meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module. | Review the application documentation and interview the application administrator. Identify if the application provides access to cryptographic modules and if access is required in order to manage cryptographic modules contained within the a | |
| APSC-DV-001870 | The application must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users). | Review the application documentation and interview the application administrator. If the application does not host non-organizational users, this requirement is not applicable. Review the application and verify authentication is enabled and | |
| APSC-DV-001880 | The application must accept Personal Identity Verification (PIV) credentials from other federal agencies. | Review the application documentation and interview the application administrator to identify application access methods. If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable. If | |
| APSC-DV-001890 | The application must electronically verify Personal Identity Verification (PIV) credentials from other federal agencies. | Review the application documentation and interview the application administrator to identify application access methods. If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable. If | |
| APSC-DV-001900 | The application must accept Federal Identity, Credential, and Access Management (FICAM)-approved third-party credentials. | Review the application documentation and interview the application administrator to identify application access methods. If the application is not PKI-enabled due to the hosted data being publicly releasable, this check is Not Applicable. I | |
| APSC-DV-001910 | The application must conform to Federal Identity, Credential, and Access Management (FICAM)-issued profiles. | Review the application documentation and interview the application administrator to identify application access methods. If the application is not PKI-enabled due to the hosted data being publicly releasable, this check is Not Applicable. I | |
| APSC-DV-001930 | Applications used for non-local maintenance sessions must audit non-local maintenance and diagnostic sessions for organization-defined auditable events. | Review the application documentation and interview the application administrator to identify application maintenance functions. If the application does not provide non-local maintenance and diagnostic capability, this requirement is not app | |
| APSC-DV-001940 | Applications used for non-local maintenance sessions must implement cryptographic mechanisms to protect the integrity of non-local maintenance and diagnostic communications. | Review the application documentation and interview the application administrator to identify application maintenance functions. If the application does not provide non-local maintenance and diagnostic capability, this requirement is not app | |
| APSC-DV-001950 | Applications used for non-local maintenance sessions must implement cryptographic mechanisms to protect the confidentiality of non-local maintenance and diagnostic communications. | Review the application documentation and interview the application administrator to identify application maintenance functions. If the application does not provide non-local maintenance and diagnostic capability, this requirement is not app | |
| APSC-DV-001960 | Applications used for non-local maintenance sessions must verify remote disconnection at the termination of non-local maintenance and diagnostic sessions. | Review the application documentation and interview the application administrator to identify application maintenance functions. If the application does not provide non-local maintenance and diagnostic capability, this requirement is not app | |
| APSC-DV-001970 | The application must employ strong authenticators in the establishment of non-local maintenance and diagnostic sessions. | Review the application documentation and interview the application administrator to identify application maintenance functions. If the application does not provide non-local maintenance and diagnostic capability, this requirement is not app | |
| APSC-DV-001980 | The application must terminate all sessions and network connections when nonlocal maintenance is completed. | Review the application documentation and interview the system administrator to determine how the application is configured to terminate network sessions after sessions have been idle for a period of time. Identify any documented exceptions. | |
| APSC-DV-001995 | The application must not be vulnerable to race conditions. | Review the application documentation and architecture. If the application is a COTS application and the vendor will not provide code review test results that demonstrate the application has been tested and is not susceptible to race conditi | |
| APSC-DV-002000 | The application must terminate all network connections associated with a communications session at the end of the session. | Review the application documentation and interview the system administrator to determine how the application is designed and configured to terminate network connections at the end of the application session. Identify any documented exceptio | |
| APSC-DV-002010 | The application must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. | Review the application documentation, system security plan and interview the application administrator to determine if the application processes classified data. If the application does not process classified data, this requirement is not a | |
| APSC-DV-002020 | The application must utilize FIPS-validated cryptographic modules when signing application components. | Review the application documentation and interview the application administrator to identify the cryptographic modules used by the application. Review the application components and application requirements. Interview application developers | |
| APSC-DV-002030 | The application must utilize FIPS-validated cryptographic modules when generating cryptographic hashes. | Review the application components and the application requirements to determine if the application is capable of generating cryptographic hashes. Review the application documentation and interview the application developer or administrator | |
| APSC-DV-002040 | The application must utilize FIPS-validated cryptographic modules when protecting unclassified information that requires cryptographic protection. | Interview the system administrator, review the application components, and the application requirements to determine if the application processes data requiring cryptographic protection. Review the application documentation and interview th | |
| APSC-DV-002050 | Applications making SAML assertions must use FIPS-approved random numbers in the generation of SessionIndex in the SAML element AuthnStatement. | Interview the system administrator, review the application components, and the application requirements to determine if the application uses SAML assertions. If the application does not use SAML assertions, the requirement is not applicable | |
| APSC-DV-002150 | The application user interface must be either physically or logically separated from data storage and management interfaces. | Review the application documentation and interview the application administrator. Review the design documents and the interfaces used by the application. Verify that the application provides separate interfaces for user traffic and for mana | |
| APSC-DV-002210 | The application must set the HTTPOnly flag on session cookies. | Review the application documentation and interview the application administrator to identify when session cookies are created. Identify any mitigating controls the application developer may have implemented. Examples include utilizing a sep | |
| APSC-DV-002220 | The application must set the secure flag on session cookies. | Review the application documentation and interview the application administrator to identify when session cookies are created. If vulnerability scan results are available, reference the most recent vulnerability scan results. Verify that th | |
| APSC-DV-002230 | The application must not expose session IDs. | Review the application documentation and configuration. Interview the application administrator and obtain implementation documentation identifying system architecture. Identify the application communication paths. This includes system to s | |
| APSC-DV-002240 | The application must destroy the session ID value and/or cookie on logoff or browser close. | Review the application documentation and interview the application administrator. Identify how the application destroys session IDs. If using a web development framework, ask the application administrator to provide details on the framework | |
| APSC-DV-002250 | Applications must use system-generated session identifiers that protect against session fixation. | Review the application documentation and interview the application administrator to identify how the application generates user session IDs. Application session testing is required in order to verify this requirement. Request the latest app | |
| APSC-DV-002260 | Applications must validate session identifiers. | Review the application documentation and interview the application administrator. Identify how the application validates session IDs. If using a web development framework, ask the application administrator to provide details on the framewor | |
| APSC-DV-002270 | Applications must not use URL embedded session IDs. | Review the application documentation and interview the application administrator. Identify how the application generates session IDs. If using a web development framework, ask the application administrator to provide details on the framewor | |
| APSC-DV-002280 | The application must not re-use or recycle session IDs. | Review the application documentation and interview the application administrator to identify how the application generates user session IDs. Application session testing is required in order to verify this requirement. Request the latest app | |
| APSC-DV-002290 | The application must generate a unique session identifier using a FIPS 140-2/140-3 approved random number generator. | Review the application server configuration and documentation to determine if the application server uses a FIPS 140-2/140-3 approved random number generator to create unique session identifiers. Have a user log on to the application server | |
| APSC-DV-002300 | The application must only allow the use of DoW-approved certificate authorities for verification of the establishment of protected sessions. | Review the application documentation and interview the application administrator to identify certificate location. Internet Explorer can be used to view certificate information: Select “Tools” Select “Internet Options” Select “Content” tab | |
| APSC-DV-002310 | The application must fail to a secure state if system initialization fails, shutdown fails, or aborts fail. | Review application design documentation, vulnerability scanner reports and interview application administrator to identify application components. The design of the application should account for the following: - Connections to databases ar | |
| APSC-DV-002320 | In the event of a system failure, applications must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes. | Review application documentation, interview application administrator to identify how the application logs error events. The application operational requirements documentation should provide the specific information that must be preserved i | |
| APSC-DV-002330 | The application must protect the confidentiality and integrity of stored information when required by DoW policy or the information owner. | Review the application documentation and interview the application administrator. Identify the data processed by the application and the accompanying data protection requirements. Determine if the data owner has specified stored data protec | |
| APSC-DV-002340 | The application must implement approved cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined information system components. | Review the documentation and interview the application administrator. Identify the data processed by the application and the accompanying data protection requirements. Determine if the data owner has specified data protection encryption req | |
| APSC-DV-002350 | The application must use appropriate cryptography in order to protect stored DoW information when required by the information owner or DoW policy. | Review the application documentation and interview the application administrator. Identify the data processed by the application and the accompanying data protection requirements. Determine if the application is processing publicly releasab | |
| APSC-DV-002360 | The application must isolate security functions from non-security functions. | Review the application documentation and interview the application administrator. Identify if the application utilizes access controls. Commonly employed access controls include Role-Based Access Controls (RBAC), Access Control Lists (ACL) | |
| APSC-DV-002370 | The application must maintain a separate execution domain for each executing process. | Review the application documentation, the architecture documentation and interview the application administrator. Identify if the application architecture provides the capability to sandbox executing processes so as to prevent a process in | |
| APSC-DV-002380 | Applications must prevent unauthorized and unintended information transfer via shared system resources. | Review the application documentation and interview the application administrator to identify if the application shares information resources via file sharing protocol or if the application includes configuration settings that provide access | |
| APSC-DV-002390 | XML-based applications must mitigate DoS attacks by using XML filters, parser options, or gateways. | Review the application architecture documentation and interview the application administrator to identify what steps have been taken to protect the XML aspect of the application from DoS attacks. If the application does not contain or utili | |
| APSC-DV-002400 | The application must restrict the ability to launch Denial of Service (DoS) attacks against itself or other information systems. | Review the application documentation and interview the application administrator. Ask the application administrator if any anti-DoS technology or anti-DoS emergency response services are deployed to protect the application. Check for code r | |
| APSC-DV-002410 | The web service design must include redundancy mechanisms when used with high-availability systems. | Interview the application administrator and review the system documentation to determine if the application has been designated as a high availability system and if the application is designed to operate in a high availability environment. | |
| APSC-DV-002440 | The application must protect the confidentiality and integrity of transmitted information. | Review the application documentation and interview the application administrator. Identify application clients, servers and associated network connections including application networking ports. Identify the types of data processed by the a | |
| APSC-DV-002450 | The application must implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS). | Review the application documentation, the application architecture designs and interview the application administrator. Ask the application admin to identify the network path taken by the application data and demonstrate the application sup | |
| APSC-DV-002460 | The application must maintain the confidentiality and integrity of information during preparation for transmission. | Review the application documentation and interview the application administrator. Identify web servers and associated network connections. Access the application with a web browser. Verify the web browser goes secure automatically by automa | |
| APSC-DV-002470 | The application must maintain the confidentiality and integrity of information during reception. | Review the application documentation and interview the application administrator. Identify web servers and associated network connections. Access the application with a web browser. Verify the web browser goes secure automatically by automa | |
| APSC-DV-002480 | The application must not disclose unnecessary information to users. | Review the application system documentation and interview the application administrators. Ask them to demonstrate how the web server and application configuration does not disclose any information about the application which could be used b | |
| APSC-DV-002485 | The application must not store sensitive information in hidden fields. | Interview application administrator and review application documentation to identify and familiarize with the application features and functions. Request most recent code review and vulnerability scan results. Review test configuration to e | |
| APSC-DV-002490 | The application must protect from Cross-Site Scripting (XSS) vulnerabilities. | Review the application documentation and the vulnerability assessment scan results from automated vulnerability assessment tools. Verify scan configuration settings include web-based applications settings which include XSS tests. Review sca | |
| APSC-DV-002500 | The application must protect from Cross-Site Request Forgery (CSRF) vulnerabilities. | Review the application documentation, the code review reports and the vulnerability assessment scan results from the automated vulnerability assessment tools. Verify scan configuration settings include web-based application settings which i | |
| APSC-DV-002510 | The application must protect from command injection. | Review the application documentation and the system configuration settings. Interview the application administrator for details regarding security assessment including automated code review and vulnerability scans conducted to test for comm | |
| APSC-DV-002520 | The application must protect from canonical representation vulnerabilities. | Review the application documentation and interview the application administrator for details regarding security assessment code reviews or vulnerability scans. Review the scan results from the entire application. This can be provided as res | |
| APSC-DV-002530 | The application must validate all input. | Review the application documentation, the code review reports and the vulnerability assessment scan results from automated vulnerability assessment tools. Verify scan configuration settings include input validation and fuzzing tests. Test d | |
| APSC-DV-002540 | The application must not be vulnerable to SQL Injection. | Review the application documentation and interview the application administrator. Request the latest vulnerability scan test results. Verify the scan configuration is configured to test for SQL injection flaws. Review the scan results to de | |
| APSC-DV-002550 | The application must not be vulnerable to XML-oriented attacks. | Review the application documentation, the application architecture and interview the application administrator. Identify any XML-based web services or XML functionality performed by the application. Determine if an XML firewall is deployed | |
| APSC-DV-002560 | The application must not be subject to input handling vulnerabilities. | Review the application documentation and interview the application administrator. If working with the developer, request documentation on their development processes and what their standard operating procedure is for sanitizing all applicat | |
| APSC-DV-002570 | The application must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries. | Review the application documentation and interview the application administrator for details regarding how the application displays error messages. Utilize the application as a non-privileged user and attempt to execute functionality that w | |
| APSC-DV-002580 | The application must reveal error messages only to the ISSO, ISSM, or SA. | Review the application documentation and interview the application administrator for details regarding how the application displays error messages. Authenticate to the application as a non-privileged user and attempt to execute functionalit | |
| APSC-DV-002590 | The application must not be vulnerable to overflow attacks. | Review the application documentation and architecture. Interview the application admin and identify the most recent code testing and analysis that has been conducted. Review the test results; verify configuration of analysis tools are set t | |
| APSC-DV-002610 | The application must remove organization-defined software components after updated versions have been installed. | Review the application documentation and interview the application admin to identify application locations on system. Identify application versions that are installed on the system. Review the file system structure to see if older versions | |
| APSC-DV-002630 | Security-relevant software updates and patches must be kept up to date. | Review the application documentation to identify application versions and patching. Interview the application administrator and inquire about patching process. Review IAVMs and CTOs to determine if the application is being updated in accord | |
| APSC-DV-002760 | The application performing organization-defined security functions must verify correct operation of security functions. | Review the application documentation and interview the system administrator to determine if the application performs security function testing. If the application is not designed or intended to perform security function testing, the require | |
| APSC-DV-002770 | The application must perform verification of the correct operation of security functions: upon system startup and/or restart; upon command by a user with privileged access; and/or every 30 days. | Review the application documentation and interview the system administrator to determine if the application performs security function testing. If the application is not designed or intended to perform security function testing, the require | |
| APSC-DV-002780 | The application must notify the ISSO and ISSM of failed security verification tests. | Review the application documentation and interview the system administrator to determine if the application performs security function testing. If the application is not designed or intended to perform security function testing, the require | |
| APSC-DV-002870 | Unsigned Category 1A mobile code must not be used in the application in accordance with DoW policy. | Review the application documentation and interview the application administrator to identify any mobile code that is provided by the application for client consumption. If the application does not contain mobile code, or if the mobile code | |
| APSC-DV-002880 | The ISSO must ensure an account management process is implemented, verifying only authorized users can gain access to the application, and individual accounts designated as inactive, suspended, or terminated are promptly removed. | Interview the application representative to verify that a documented process exists for user and system account creation, termination, and expiration. Obtain a list of recently departed personnel and verify that their accounts were removed | |
| APSC-DV-002890 | Application web servers must be on a separate network segment from the application and database servers if it is a tiered application operating in the DoW DMZ. | Review the application documentation. Review the application data protection requirements and identify if all data types hosted on server are identical. Review the network diagram and identify web servers/web services, web application serve | |
| APSC-DV-002900 | The ISSO must ensure application audit trails are retained for at least 30 months (12 months active + 18 months cold storage) for applications without SAMI data and five years for applications including SAMI data. | Verify a process is in place to retain application audit log files for 30 months (12 months active + 18 months cold storage) for non-SAMI data and five years for SAMI data. If audit logs have not been retained for 30 months (12 months activ | |
| APSC-DV-002910 | The ISSO must review audit trails periodically based on system documentation recommendations or immediately upon system security events. | Interview the application representative and ask for the system documentation that states how often audit logs are reviewed. Also, determine when the audit logs were last reviewed. If the application representative cannot provide system doc | |
| APSC-DV-002920 | The ISSO must report all suspected violations of IA policies in accordance with DoW information system IA procedures. | Interview the application representative and review the SOPs to ensure that violations of IA policies are analyzed and reported. If there is no policy for reporting IA violations, this is a finding. | |
| APSC-DV-002930 | The ISSO must ensure active vulnerability testing is performed. | Ask the application representative to provide vulnerability test procedures and vulnerability test results. Ask the application representative to provide the settings that were used to conduct the vulnerability testing. Verify the automated | |
| APSC-DV-002950 | Execution flow diagrams and design documents must be created to show how deadlock and recursion issues in web services are being mitigated. | Review the application documentation and the system diagrams detailing application system to system and service to service communication methods. Interview the application admin to identify any application web services that are deployed by | |
| APSC-DV-002960 | The designer must ensure the application does not store configuration and control files in the same directory as user data. | Review the application documentation and interview the application administrator. Ask the application administrator or examine the application documentation to determine the file location of the application configuration settings and user d | |
| APSC-DV-002970 | The ISSO must ensure if a DoW STIG or NSA guide is not available, a third-party product will be configured by following available guidance. | Review the application documentation to identify application name, features and version. Identify if a DoW STIG or NSA guide is available. If no STIG is available for the product, the application and application components must be configure | |
| APSC-DV-002980 | New IP addresses, data services, and associated ports used by the application must be submitted to the appropriate approving authority for the organization, which in turn will be submitted through the DoW Ports, Protocols, and Services Management (DoW PPSM) | All application ports, protocols, and services needed for application operation need to be in compliance with the DoW Ports and Protocols guidance. Check: http://iase.disa.mil/ppsm/Pages/index.aspx to verify the ports, protocols, and servic | |
| APSC-DV-002990 | The application must be registered with the DoW Ports and Protocols Database. | Verify registration of the application and ports in the Ports and Protocols Database for a production site. If the application requires registration, and is not registered or all ports used have not been identified in the database, this is | |
| APSC-DV-002995 | The Configuration Management (CM) repository must be properly patched and STIG compliant. | Review the application system documentation and interview the application administrator. Identify if the STIG is being applied to application developers or organizations responsible for code management or who have and operate an application | |
| APSC-DV-003000 | Access privileges to the Configuration Management (CM) repository must be reviewed every three months. | Review the application system documentation. Interview the application administrator. Identify if development of the application is done in house and if application configuration management repository exists. If application development is n | |
| APSC-DV-003010 | A Software Configuration Management (SCM) plan describing the configuration control and change management process of application objects developed by the organization and the roles and responsibilities of the organization must be created and maintained. | Interview ISSM or application administrator. Identify if development of the application is done in house and if application configuration management repository exists. If application development is not done in house and if a code configurat | |
| APSC-DV-003020 | A Configuration Control Board (CCB) that meets at least every release cycle, for managing the Configuration Management (CM) process must be established. | Interview the application representative and determine if application development is performed on site by the organization. If application development is not done in house, the requirement is not applicable. If so, determine if a CCB exists | |
| APSC-DV-003030 | The application services and interfaces must be compatible with and ready for IPv6 networks. | Verify the application environment is compliant with all DoW IPv6 Standards Profile for IPv6 Capable Products guidance for servers. If the application environment is not compliant with all DoW IPv6 Standards Profile for IPv6 Capable Product | |
| APSC-DV-003040 | The application must not be hosted on a general purpose machine if the application is designated as critical or high availability by the ISSO. | Ask the application representative to review the servers where the application is deployed. Ask what other applications are deployed on those servers. Identify the criticality of the applications installed on the system. If a mission critic | |
| APSC-DV-003050 | A contingency plan must exist in accordance with DoW policy based on the application's availability requirements. | Review contingency plans. For high availability applications, verify the contingency plan exists and provides for the smooth transfer of all mission or business essential functions to an alternate site for the duration of an event with litt | |
| APSC-DV-003060 | Recovery procedures and technical system features must exist so recovery is performed in a secure and verifiable manner. The ISSO will document circumstances inhibiting a trusted recovery. | Review disaster recovery plan. Verify that a disaster recovery plan is in place for the application. Verify that the recovery procedures include any special considerations for trusted recovery. If the application is not part of the site’s d | |
| APSC-DV-003070 | Data backup must be performed at required intervals in accordance with DoW policy. | Interview the application and system admins and review documented backup procedures. Check the following based on the risk level of the application. For low risk applications: Validate backup procedures exist and are performed at least week | |
| APSC-DV-003080 | Back-up copies of the application software or source code must be stored in a fire-rated container or stored separately (offsite). | When reviewing a COTS or GOTS application, verify that a back-up copy of the software is stored in a fire rated container or is stored separately (offsite) from the operational environment. Determine if application development is done in-ho | |
| APSC-DV-003090 | Procedures must be in place to assure the appropriate physical and technical protection of the backup and restoration of the application. | Validate that backup and recovery procedures incorporate protection of the backup and restoration assets. Verify assets housing the backup data (e.g., SANS, tapes, backup directories, software) and the assets used for restoration (e.g., equ | |
| APSC-DV-003100 | The application must use encryption to implement key exchange and authenticate endpoints prior to establishing a communication channel for key exchange. | If the application does not implement key exchange, this check is not applicable. Identify all application or supporting infrastructure features using key exchange. Verify the application is using FIPS-140-2 validated cryptographic modules | |
| APSC-DV-003110 | The application must not contain embedded authentication data. | Review the application documentation and any available source code; this includes configuration files such as global.asa, if present, scripts, HTML files, and any ASCII files. Identify any instances of passwords, certificates, or sensitive | |
| APSC-DV-003120 | The application must have the capability to mark sensitive/classified output when required. | Review the application documentation and interview the application administrator. Ask the application representative for the application’s classification guide. This guide should document the data elements and their classification. Determin | |
| APSC-DV-003130 | Prior to each release of the application, updates to system, or applying patches; tests plans and procedures must be created and executed. | If the review is not being done with the developer of the application, this requirement is not applicable. Ask the application representative to provide tests plans, procedures, and results to ensure they are updated for each application re | |
| APSC-DV-003140 | Application files must be cryptographically hashed prior to deploying to DoW operational networks. | Ask the application representative to demonstrate their cryptographic hash validation process or provide process documentation. The validation process will vary based upon the operating system used as there are numerous clients available th | |
| APSC-DV-003150 | At least one tester must be designated to test for security flaws in addition to functional testing. | Review the organization chart and interview the admin staff. Identify personnel designated as application security testers. If the organization operating the application is not doing development work, this requirement is not applicable. If | |
| APSC-DV-003160 | Test procedures must be created and at least annually executed to ensure system initialization, shutdown, and aborts are configured to verify the system remains in a secure state. | Review the process documentation and interview the admin staff. Identify if testing procedures exist and if they include annual testing to ensure the application remains in a secure state on initialization, shutdown, and aborts. Checks shou | |
| APSC-DV-003170 | An application code review must be performed on the application. | This requirement is meant to apply to developers or organizations that are doing the application development work and have the responsibility for maintaining the application source code. Otherwise, the requirement is not applicable. Review | |
| APSC-DV-003180 | Code coverage statistics must be maintained for each release of the application. | If the organization does not do or manage the application development work for the application, this requirement is not applicable. Ask the application representative to provide code coverage statistics maintained for the application. If th | |
| APSC-DV-003190 | Flaws found during a code review must be tracked in a defect tracking system. | This requirement is meant to apply to developers or organizations that are doing application development work. If application development is not being done or managed by the organization, this requirement is not applicable. Ask the applicat | |
| APSC-DV-003200 | The changes to the application must be assessed for IA and accreditation impact prior to implementation. | Interview the application and system administrators and determine if changes to the application are assessed for IA impact prior to implementation. Review the CCB process documentation to ensure potential changes to the application are eval | |
| APSC-DV-003210 | Security flaws must be fixed or addressed in the project plan. | This requirement is meant to apply to developers or organizations that are doing application development work. If the organization managing the application is not performing or managing the development of the application the requirement is | |
| APSC-DV-003215 | The application development team must follow a set of coding standards. | This requirement is meant to apply to developers or organizations that are doing application development work. If the organization operating the application under review is not doing the development or managing the development of the applic | |
| APSC-DV-003220 | The designer must create and update the Design Document for each release of the application. | This requirement is meant to apply to developers or organizations that are doing application development work. If the organization operating the application is not doing the development or managing the development of the application, the re | |
| APSC-DV-003230 | Threat models must be documented and reviewed for each application release and updated as required by design and functionality changes or when new threats are discovered. | This requirement is meant to apply to developers or organizations that are doing application development work. If the organization operating the application is not doing the development or is not managing the development of the application, | |
| APSC-DV-003235 | The application must not be subject to error handling vulnerabilities. | Review the application documentation, code review reports and the results from static code analysis tools. Identify the most recent security scans and code analysis testing conducted. Verify testing configuration includes tests for error ha | |
| APSC-DV-003236 | The application development team must provide an application incident response plan. | If the application is a COTS application and the development team is not accessible to interview this requirement is not applicable. Interview the application development team members. Request and review the application incident response pl | |
| APSC-DV-003240 | All products must be supported by the vendor or the development team. | Review the application documentation and interview the application administrator. Identify all software components. Review the version information and identify the vendor if COTS software. Access the vendor website to verify the version is | |
| APSC-DV-003250 | The application must be decommissioned when maintenance or support is no longer available. | Interview the application representative and determine if all the application components are under maintenance contract. The entire application may be covered by a single maintenance agreement. The application should be decommissioned if ma | |
| APSC-DV-003260 | Procedures must be in place to notify users when an application is decommissioned. | Interview the application representative to determine if provisions are in place to notify users when an application is decommissioned. If provisions are not in place to notify users when an application is decommissioned, this is a finding. | |
| APSC-DV-003270 | Unnecessary built-in application accounts must be disabled. | Review the application documentation and identify if the application creates or utilizes built-in accounts. Examine the account list for obvious examples (e.g., accounts with vendor names such as Oracle or Tivoli). Verify that these account | |
| APSC-DV-003280 | Default passwords must be changed. | Identify the application name and version and do an Internet search for the product name and the string "default password". If default passwords are found, attempt to authenticate with the published default passwords. If authentication is s | |
| APSC-DV-003285 | An Application Configuration Guide must be created and included with the application. | Interview the application administrator. Request and review the Application Configuration Guide. Verify the configuration guide at a minimum provides configuration details for the following examples. The examples provided herein are not int | |
| APSC-DV-003290 | If the application contains classified data, a Security Classification Guide must exist containing data elements and their classification. | If the application does not process classified information, this check is not applicable. The application may already be covered by a higher level program or other classification guide. If the classification guide is not written specificall | |
| APSC-DV-003300 | The designer must ensure uncategorized or emerging mobile code is not used in applications. | Review the application documentation and interview application administrator. Determine what mobile code types are used by the application. If uncategorized mobile code types are found, ask the application administrator to provide the docum | |
| APSC-DV-003310 | Production database exports must have database administration credentials and sensitive data removed before releasing the export. | Review the application documentation and identify the existence of databases within the application architecture. Ask the application admin to identify when data exports from this database are imported to test or development databases. If n | |
| APSC-DV-003320 | Protections against DoS attacks must be implemented. | Ask the application representative for the threat model document. Examine the threat model document and determine if DoS attacks are specified as a threat. If there are no DoS threats identified in the threat model, the requirement is not a | |
| APSC-DV-003330 | The system must alert an administrator when low resource conditions are encountered. | Review the system documentation and interview the application and system administrators. Examine the system to determine if an automated, continuous on-line monitoring and audit trail creation capability is present with the capability to im | |
| APSC-DV-003340 | At least one application administrator must be registered to receive update notifications, or security alerts, when automated alerts are available. | Review the components of the application. Ask the application representative to demonstrate deployment personnel are registered to receive notifications for update notification for all of the application components including custom-develope | |
| APSC-DV-003345 | The application must provide notifications or alerts when product update and security related patches are available. | Review the components of the application. Interview the application administrator. Have the application administrator demonstrate the application notification process that occurs when a security patch or product update is available. The pro | |
| APSC-DV-003350 | Connections between the DoW enclave and the Internet or other public or commercial wide area networks must require a DMZ. | Interview the application representative and determine if the application is publicly accessible. If the application is publicly accessible and traffic is not being routed through a DMZ, this is a finding. | |
| APSC-DV-003360 | The application must generate audit records when concurrent logons from different workstations occur. | Review the application documentation and interview the application administrator to identify where log records are stored. Access log records then log on to the application as a regular user from one workstation. Take note of workstation IP | |
| APSC-DV-003400 | The Program Manager must verify all levels of program management, designers, developers, and testers receive annual security training pertaining to their job function. | This requirement is meant to be applied to developers and development teams only, otherwise, this requirement is not applicable. Interview the application representative. Ask for evidence of annual security training for application managers |
286 of 286.