DISA STIG library V6R5
| Ref | Title | Text | |
|---|---|---|---|
| APSC-DV-000190 | Messages protected with WS_Security must use time stamps with creation and expiration times. | Ask the application representative for the design document. Review the design document for web services using WS-Security tokens. If the application does not utilize WS-Security tokens, this check is not applicable. Examine the contents of | |
| APSC-DV-000200 | Validity periods must be verified on all application messages using WS-Security or SAML assertions. | Ask the application representative for the design document. Review the design document for web services. If the application does not utilize WSS or SAML assertions, this requirement is not applicable. Review the design document and verify v | |
| APSC-DV-000230 | The application must use the NotOnOrAfter condition when using the SubjectConfirmation element in a SAML assertion. | Ask the application representative for the design document. Review the design document for web services using SAML assertions. If the application does not utilize SAML assertions, this check is not applicable. Examine the contents of a SOAP | |
| APSC-DV-000240 | The application must use both the NotBefore and NotOnOrAfter elements or OneTimeUse element when using the Conditions element in a SAML assertion. | Ask the application representative for the design document. Review the design document for web services using SAML assertions. If the application does not utilize SAML assertions, this check is not applicable. Examine the contents of a SOAP | |
| APSC-DV-000460 | The application must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. | Review the application documentation and interview the application administrator. Review application data protection requirements. Identify application resources that require protection and authentication over and above the authentication r | |
| APSC-DV-000510 | The application must execute without excessive account permissions. | Review the system documentation or interview the application representative and identify if the application utilizes an account in order to operate. Determine the OS user groups in which each application account is a member. List the user r | |
| APSC-DV-000530 | The application must enforce the limit of three consecutive invalid logon attempts by a user during a 15 minute time period. | All testing must be performed within a 15-minute window. Log on to the application with a test user account. Intentionally enter an incorrect user password or pin. Repeat 2 times within 15 minutes for a total of three failed attempts. Notif | |
| APSC-DV-001540 | The application must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users). | Review the application documentation and interview the application administrator to determine how organizational users access the application. If the application is publicly available, providing access to publicly releasable data and the us | |
| APSC-DV-001680 | The application must enforce a minimum 15-character password length. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access th | |
| APSC-DV-001740 | The application must only store cryptographic representations of passwords. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Have the | |
| APSC-DV-001750 | The application must transmit only cryptographically-protected passwords. | Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, the requirement is not applicable. Identify w | |
| APSC-DV-001810 | The application, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. | Review the application documentation, the application architecture and interview the application administrator to identify the method employed by the application for validating certificates. Review the method to determine if a certification | |
| APSC-DV-001820 | The application, when using PKI-based authentication, must enforce authorized access to the corresponding private key. | Review the application documentation and interview the application administrator to identify where the application's private key is stored. If the application does not perform code signing or other cryptographic tasks requiring a private ke | |
| APSC-DV-001850 | The application must not display passwords/PINs as clear text. | Ask the application admin to log on to the application. Observe the authentication process and verify any display feedback provided when the admin enters her/his password is obfuscated and not clear text. For applications that display authe | |
| APSC-DV-001860 | The application must use mechanisms meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module. | Review the application documentation and interview the application administrator. Identify if the application provides access to cryptographic modules and if access is required in order to manage cryptographic modules contained within the a | |
| APSC-DV-002230 | The application must not expose session IDs. | Review the application documentation and configuration. Interview the application administrator and obtain implementation documentation identifying system architecture. Identify the application communication paths. This includes system to s | |
| APSC-DV-002240 | The application must destroy the session ID value and/or cookie on logoff or browser close. | Review the application documentation and interview the application administrator. Identify how the application destroys session IDs. If using a web development framework, ask the application administrator to provide details on the framework | |
| APSC-DV-002310 | The application must fail to a secure state if system initialization fails, shutdown fails, or aborts fail. | Review application design documentation, vulnerability scanner reports and interview application administrator to identify application components. The design of the application should account for the following: - Connections to databases ar | |
| APSC-DV-002340 | The application must implement approved cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined information system components. | Review the documentation and interview the application administrator. Identify the data processed by the application and the accompanying data protection requirements. Determine if the data owner has specified data protection encryption req | |
| APSC-DV-002350 | The application must use appropriate cryptography in order to protect stored DoW information when required by the information owner or DoW policy. | Review the application documentation and interview the application administrator. Identify the data processed by the application and the accompanying data protection requirements. Determine if the application is processing publicly releasab | |
| APSC-DV-002440 | The application must protect the confidentiality and integrity of transmitted information. | Review the application documentation and interview the application administrator. Identify application clients, servers and associated network connections including application networking ports. Identify the types of data processed by the a | |
| APSC-DV-002485 | The application must not store sensitive information in hidden fields. | Interview application administrator and review application documentation to identify and familiarize with the application features and functions. Request most recent code review and vulnerability scan results. Review test configuration to e | |
| APSC-DV-002490 | The application must protect from Cross-Site Scripting (XSS) vulnerabilities. | Review the application documentation and the vulnerability assessment scan results from automated vulnerability assessment tools. Verify scan configuration settings include web-based applications settings which include XSS tests. Review sca | |
| APSC-DV-002510 | The application must protect from command injection. | Review the application documentation and the system configuration settings. Interview the application administrator for details regarding security assessment including automated code review and vulnerability scans conducted to test for comm | |
| APSC-DV-002540 | The application must not be vulnerable to SQL Injection. | Review the application documentation and interview the application administrator. Request the latest vulnerability scan test results. Verify the scan configuration is configured to test for SQL injection flaws. Review the scan results to de | |
| APSC-DV-002550 | The application must not be vulnerable to XML-oriented attacks. | Review the application documentation, the application architecture and interview the application administrator. Identify any XML-based web services or XML functionality performed by the application. Determine if an XML firewall is deployed | |
| APSC-DV-002560 | The application must not be subject to input handling vulnerabilities. | Review the application documentation and interview the application administrator. If working with the developer, request documentation on their development processes and what their standard operating procedure is for sanitizing all applicat | |
| APSC-DV-002590 | The application must not be vulnerable to overflow attacks. | Review the application documentation and architecture. Interview the application admin and identify the most recent code testing and analysis that has been conducted. Review the test results; verify configuration of analysis tools are set t | |
| APSC-DV-002890 | Application web servers must be on a separate network segment from the application and database servers if it is a tiered application operating in the DoW DMZ. | Review the application documentation. Review the application data protection requirements and identify if all data types hosted on server are identical. Review the network diagram and identify web servers/web services, web application serve | |
| APSC-DV-003110 | The application must not contain embedded authentication data. | Review the application documentation and any available source code; this includes configuration files such as global.asa, if present, scripts, HTML files, and any ASCII files. Identify any instances of passwords, certificates, or sensitive | |
| APSC-DV-003120 | The application must have the capability to mark sensitive/classified output when required. | Review the application documentation and interview the application administrator. Ask the application representative for the application’s classification guide. This guide should document the data elements and their classification. Determin | |
| APSC-DV-003240 | All products must be supported by the vendor or the development team. | Review the application documentation and interview the application administrator. Identify all software components. Review the version information and identify the vendor if COTS software. Access the vendor website to verify the version is | |
| APSC-DV-003250 | The application must be decommissioned when maintenance or support is no longer available. | Interview the application representative and determine if all the application components are under maintenance contract. The entire application may be covered by a single maintenance agreement. The application should be decommissioned if ma | |
| APSC-DV-003280 | Default passwords must be changed. | Identify the application name and version and do an Internet search for the product name and the string "default password". If default passwords are found, attempt to authenticate with the published default passwords. If authentication is s |
34 of 286.