BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

APSC-DV-003110 The application must not contain embedded authentication data.

DISA STIG library V6R5
All changes in this version
first version loaded CAT I

Maps to IA-5(7) via CCI-002367

Title

The application must not contain embedded authentication data.

Control

Review the application documentation and any available source code; this includes configuration files such as global.asa, if present, scripts, HTML files, and any ASCII files. Identify any instances of passwords, certificates, or sensitive data included in code. If credentials were found, check the file permissions and ownership of the offending file. If access to the folder hosting the file is not restricted to the related application process and administrative users, this is a finding. The finding details should note specifically where the offending credentials or data were located and what resources they enabled.

Discussion

Authentication data stored in code could potentially be read and used by anonymous users to gain access to a backend database or application servers. This could lead to compromise of application data.

Related controls

CCI-002367

Fix

Remove embedded authentication data stored in code, configuration files, scripts, HTML file, or any ASCII files.