Applications STIGs

All 286 CAT I 34 CAT II 230CAT III 22 Browse in the Register

CAT II 230

Any vulnerability, the exploitation of which has a potential to result in loss of confidentiality, availability or integrity.

APSC-DV-000010 CAT II V-222387 · SRG-APP-000001

The application must provide a capability to limit the number of logon sessions per user.

Maps to AC-10 via CCI-000054

Check
For production environments; Review the system documentation, identify the number of application user logon sessions allowed per user, identify the methods utilized for user session management or have application administrator describe how the application implements user session management. Utilize the management interface that is used to set the user session values, or examine configuration files in order to review user session configuration settings. Ensure the number of sessions allowed per user is specified in accordance with the organizational requirements. For development environments; have the developer provide design documentation or demonstrate how the application is designed to limit the number of simultaneous user logon sessions. If the application is not configured to limit the number of logon sessions per user as defined by the organization, this is a finding.

Fix
Design and configure the application to specify the number of logon sessions that are allowed per user.
APSC-DV-000060 CAT II V-222388 · SRG-APP-000295

The application must clear temporary storage and cookies when the session is terminated.

Maps to AC-12 via CCI-002361

Check
Review application design documentation and interview application administrator to identify how the application makes use of temporary client storage and cookies. Identify cookie and web storage locations on the client. Clear all browser cookies and web cache. Log on to the application and perform several standard operations, noting if the application ever prompts the user to accept a cookie. If prompted by the browser to save the user ID and password (decline to save the user ID and password), this is a finding. Log out of the application and close the browser. Reopen the browser and examine the stored cookies. The cookies displayed should be related to the application website. The procedure to view cookies will vary according to the browser used. Some modern browsers are making use of SQLite databases to store cookie data so use of a SQLite db reader/browser may be required. Open the cookies related to the application website and search for any identification or authentication information. While authentication information can vary on a per application basis, this is most often specified as "username=x", or "password=x". If the web application prompts the user to save their password, or if a username or password value exists within a cookie or within local storage locations, even if hashed, this is a finding. The application may use means other than cookies to store user information. If the reviewer detects an alternative mechanism for storing information locally, examine the data storage to ensure no authentication or other sensitive information is present.

Fix
Design and configure the application to clear sensitive data from cookies and local storage when the user logs out of the application.
APSC-DV-000070 CAT II V-222389 · SRG-APP-000295

The application must automatically terminate the non-privileged user session and log off non-privileged users after a 15 minute idle time period has elapsed.

Maps to AC-12 via CCI-002361

Check
Ask the application representative to demonstrate the configuration setting where the idle time out value is defined. Alternatively, logon with a regular application user account and let the session sit idle for 15 minutes. Attempt to access the application after 15 minutes of inactivity. If the configuration setting is not set to time out user sessions after 15 minutes of inactivity, or if the regular user session used for testing does not time out after 15 minutes of inactivity, this is a finding.

Fix
Design and configure the application to terminate the non-privileged users session after 15 minutes of inactivity.
APSC-DV-000080 CAT II V-222390 · SRG-APP-000295

The application must automatically terminate the admin user session and log off admin users after a 10 minute idle time period is exceeded.

Maps to AC-12 via CCI-002361

Check
Ask the application representative to demonstrate the application configuration setting where the idle time out value is defined for admin users. Alternatively, logon with an admin user account and let the session sit idle for 10 minutes. Attempt to access the application after 10 minutes of inactivity. If the configuration setting is not set to time out admin user sessions after 10 minutes of inactivity, or if the session used for testing does not time out after 10 minutes of inactivity, this is a finding.

Fix
Design and configure the application to terminate the admin users session after 10 minutes of inactivity.
APSC-DV-000090 CAT II V-222391 · SRG-APP-000296

Applications requiring user access authentication must provide a logoff capability for user initiated communication session.

Maps to AC-12(1) via CCI-002363

Check
If the application does not provide an interface for interactive user access, this is not applicable. Log on to the application with a valid user account. Examine the user interface. Identify the command or link that provides the logoff function. Activate the user logoff function. Observe user interface and attempt to interact with the application. Confirm user interaction with the application is no longer possible. If the user session is not terminated or if the logoff function does not exist, this is a finding.

Fix
Design and configure the application to provide all users with the capability to manually terminate their application session.
APSC-DV-000110 CAT II V-222393 · SRG-APP-000311

The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in storage.

Maps to AC-16 via CCI-002262

Check
Review the application documentation and interview the application administrator. Determine if the application processes classified, CUI, or other data that is required to be marked and identify if the application requirements specify data markings of any other types of data. If the application does not contain classified, CUI, or other data that is required to be marked, this requirement is not applicable. Review the database or other storage mechanism and have the application administrator identify and demonstrate how the application assigns and maintains data markings while the data is in storage. Typical methods for marking data include using a table or data base field that contains the marking information and associating the marking information with the data. If application data required to be marked is not marked and does not retain its marking while it is being stored, this is a finding.

Fix
Design and configure the application to assign data marking and ensure the marking is retained when the data is stored.
APSC-DV-000120 CAT II V-222394 · SRG-APP-000313

The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in process.

Maps to AC-16 via CCI-002263

Check
Review the application documentation and interview the application administrator. Identify if the application requirements include data marking. Also determine if the application processes classified, CUI, or other data that is required to be marked. If the application does not contain classified or CUI data or have data marking requirements, this requirement is not applicable. Access the user interface for the application and navigate through the application. Perform several application actions that will manipulate data contained within the application. For example, create a test record and assign a data marking to the data element. Save the test record, close the data entry fields, and navigate to display the test record. Perform an edit action on the test data that does not edit the marking itself, or perform any other form of data processing such as assigning the data to another user's work queue for review or printing the data. Verify the data marking is retained throughout the data processing actions. If application data required to be marked does not retain its marking while it is being processed by the application, this is a finding.

Fix
Design and configure the application to retain the data marking when processing data.
APSC-DV-000130 CAT II V-222395 · SRG-APP-000314

The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission.

Maps to AC-16 via CCI-002264

Check
Review the application documentation and interview the application administrator. Identify if the application requirements include data marking. Also determine if the application processes classified, CUI, or other data that is required to be marked. Access the user interface for the application and navigate through the application. Perform an application action that will transmit marked data that is contained within the application. If the application does not contain classified or CUI data or have data marking requirements, or if the application does not transmit data, this requirement is not applicable. For example, create a test record and assign a data marking to the data element. Save the test record, close the data entry fields, and navigate to display the test record. Initiate the application processes to transmit data. Access a remote system or have someone with access to a remote system verify the data marking is retained after the data transmission. If application data required to be marked does not retain its marking when it is being transmitted by the application, this is a finding.

Fix
Design and configure the application to retain the data marking when transmitting data.
APSC-DV-000160 CAT II V-222396 · SRG-APP-000014

The application must implement DoW-approved encryption to protect the confidentiality of remote access sessions.

Maps to AC-17(2) via CCI-000068

Check
Review the application documentation and interview the system administrator. Identify the application encryption capabilities and methods for implementing encryption protection. For web based applications; open the web browser and access the website URL. Use the browser and determine if the session is protected via TLS. A secure connection is usually indicated in the upper left hand corner of the URL by a padlock icon. Click on the padlock icon and examine the connection information. Determine if TLS encryption is used to secure the session. For non-web based applications, determine the TCP/IP port, protocol and method used for establishing client connections to the remote server. Review application configuration settings to ensure encryption is specified and via TLS. If the connection is not secured with TLS, this is a finding.

Fix
Design and configure applications to use TLS encryption to protect the confidentiality of remote access sessions.
APSC-DV-000170 CAT II V-222397 · SRG-APP-000015

The application must implement cryptographic mechanisms to protect the integrity of remote access sessions.

Maps to AC-17(2) via CCI-001453

Check
Review the application documentation and interview the system administrator. Identify the application encryption capabilities and methods for implementing encryption protection. For web based applications; open the web browser and access the website URL. Use the browser and determine if the session is protected via TLS. A secure connection is usually indicated in the upper left hand corner of the URL by a padlock icon. Click on the padlock icon and examine the connection information. Determine if TLS encryption is used to secure the session. For non-web based applications, determine the TCP/IP port, protocol and method used for establishing client connections to the remote server. Review application configuration settings to ensure encryption is specified and via TLS. If the connection is not secured with TLS, this is a finding.

Fix
Design and configure applications to use TLS encryption to protect the integrity of remote access sessions.
APSC-DV-000180 CAT II V-222398 · SRG-APP-000015

Applications with SOAP messages requiring integrity must include the following message elements:-Message ID-Service Request-Timestamp-SAML Assertion (optionally included in messages) and all elements of the message must be digitally signed.

Maps to AC-17(2) via CCI-001453

Check
Review the application documentation, system security plan, application architecture diagrams and interview the application administrator. Review the design document for web services using SOAP messages. If the application does not utilize SOAP messages, this check is not applicable. Review the design document and SOAP messages. Verify the Message ID, Service Request, Timestamp, and SAML Assertion are included in the SOAP message. If they are included, verify they are signed with a certificate. If SOAP messages requiring integrity do not have the Message ID, Service Request, Timestamp, and SAML Assertion signed, or if any part of the message is not digitally signed, this is a finding.

Fix
Design and configure the application to sign the following message elements for SOAP messages requiring integrity: - Message ID - Service Request - Timestamp - SAML Assertion - Message elements
APSC-DV-000210 CAT II V-222401 · SRG-APP-000014

The application must ensure each unique asserting party provides unique assertion ID references for each SAML assertion.

Maps to AC-17(2) via CCI-000068

Check
Ask the application representative for the design document. Review the design document for web services using SAML assertions. If the application does not utilize SAML assertions, this check is not applicable. Review the design document and verify SAML assertion identifiers are not reused by a single asserting party. If the design document does not exist, or does not indicate SAML assertion identifiers which are unique for each asserting party, this is a finding.

Fix
Design and configure each SAML assertion authority to use unique assertion identifiers.
APSC-DV-000220 CAT II V-222402 · SRG-APP-000014

The application must ensure encrypted assertions, or equivalent confidentiality protections are used when assertion data is passed through an intermediary, and confidentiality of the assertion data is required when passing through the intermediary.

Maps to AC-17(2) via CCI-000068

Check
Ask the application representative for the design document. Review the design document for web services using WS-Security tokens. If the application does not utilize WS-Security tokens, this check is not applicable. Verify all WS-Security tokens are transmitted via an approved encryption method. If the design document does not exist, or does not indicate all WS-Security tokens are only transmitted via an approved encryption method, this is a finding.

Fix
Encrypt assertions or use equivalent confidentiality when sensitive assertion data is passed through an intermediary.
APSC-DV-000250 CAT II V-222405 · SRG-APP-000014

The application must ensure if a OneTimeUse element is used in an assertion, there is only one of the same used in the Conditions element portion of an assertion.

Maps to AC-17(2) via CCI-000068

Check
Ask the application representative for the design document. Review the design document for web services using SAML assertions. If the application does not utilize SAML assertions, this check is not applicable. Examine the contents of a SOAP message using the OneTimeUse element; all messages should contain only one instance of a element in a SAML assertion. This can be accomplished using a protocol analyzer such as Wireshark. If SOAP message uses more than one, OneTimeUse element in a SAML assertion, this is a finding.

Fix
When using OneTimeUse elements in a SAML assertion only allow one, OneTimeUse element to be used in the conditions element of a SAML assertion.
APSC-DV-000260 CAT II V-222406 · SRG-APP-000014

The application must ensure messages are encrypted when the SessionIndex is tied to privacy data.

Maps to AC-17(2) via CCI-000068

Check
Ask the application representative for the design document. Review the design document for web services using SAML assertions. If the application does not utilize SAML assertions, this check is not applicable. Examine the contents of a SOAP message using a SessionIndex in the SAML element AuthnStatement. Verify the information which is tied to the SessionIndex. If the SessionIndex is tied to privacy information, and it is not encrypted, this is a finding.

Fix
Encrypt messages when the SessionIndex is tied to privacy data.
APSC-DV-000280 CAT II V-222407 · SRG-APP-000023

The application must provide automated mechanisms for supporting account management functions.

Maps to AC-2(1) via CCI-000015

Check
Review the application documentation and interview the application administrator. Identify the account management methods, processes and procedures that are used. If the application is utilizing a centralized authentication mechanism such as Active Directory or LDAP, verify all user account activity is conducted via that solution and no local user accounts that circumvent the automated solution are used. Determine if automated mechanisms are used when managing application user accounts and taking management action on application user accounts. Automated methods include but are not limited to: Taking action on accounts that have been determined to be inactive, suspended, terminated, or disabled. Automated action examples include: deleting such accounts, reactivating accounts in conjunction with a validation or verification process, or sending notifications or reminders to the account holders that their account is about to be disabled or deleted. Verify the action that is taken is automated and repeatable. If the account management process is manual in nature, this is a finding.

Fix
Use automated processes and mechanisms for account management functions.
APSC-DV-000290 CAT II V-222408 · SRG-APP-000317

Shared/group account credentials must be terminated when members leave the group.

Maps to AC-2(10), IA-2(5) via CCI-004045, CCI-002142

Check
Review the application documentation and determine if there is a requirement for shared or group accounts. If there is no official requirement for shared or group application accounts, this requirement is Not Applicable. Interview the application representative and identify shared/group accounts. Have the application representative provide their procedures for account management as it pertains to group users. Validate there is a procedure for deleting either member accounts or the entire group account when member leave the group. If there is no process for handling group account credentials, this is a finding.

Fix
Create a procedure for deleting either member accounts or the entire group account when members leave the group.
APSC-DV-000300 CAT II V-222409 · SRG-APP-000024

The application must automatically remove or disable temporary user accounts 72 hours after account creation.

Maps to AC-2(2) via CCI-000016

Check
If official documentation exist that disallows the use of temporary user accounts within the application, this requirement is not applicable. Examine the application documentation or interview the application representative to identify how the application users are managed. Navigate to the screen where user accounts are configured. Create a test account and determine if there is a setting to specify the user account as being temporary in nature. Determine if there is an available setting to expire the account after a period of time. If the application has no ability to specify a user account as being temporary in nature, or if the account has no ability to automatically disable or remove the account after 72 hours after account creation, this is a finding.

Fix
Configure temporary accounts to be automatically removed or disabled after 72 hours after account creation.
APSC-DV-000330 CAT II V-222412 · SRG-APP-000025

Unnecessary application accounts must be disabled, or deleted.

Maps to AC-2(3) via CCI-000017

Check
Review the system documentation and identify any valid application accounts that are required in order for the application to operate. Accounts the application itself uses in order to function are not in scope for this requirement. Have the application administrator generate a list of all application users. This should include relevant user metadata such as phone numbers or department identifiers. Have the application administrator identify and validate all user accounts. If any accounts cannot be validated and are deemed to be unnecessary, this is a finding.

Fix
Design the application so unessential user accounts are not created during installation. Disable or delete all unnecessary application user accounts.
APSC-DV-000340 CAT II V-222413 · SRG-APP-000026

The application must automatically audit account creation.

Maps to AC-2(4) via CCI-000018

Check
Examine the application documentation to identify how the application users are managed. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application. If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable. Identify the location of the audit logs and review the end of the logs. Access the user account management functionality and create a new user account. Examine the log file again and determine if the account creation event was logged. The information logged should, at a minimum, include enough detail to determine which account was created and when. If the account creation event was not logged, this is a finding.

Fix
Configure the application to write a log entry when a new user account is created. At a minimum, ensure account name, date and time of the event are recorded.
APSC-DV-000350 CAT II V-222414 · SRG-APP-000027

The application must automatically audit account modification.

Maps to AC-2(4) via CCI-001403

Check
Examine the application documentation to identify how the application users are managed. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application. If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable. Identify the location of the audit logs and review the end of the logs. Access the user account management functionality and modify a test user account. Examine the log file again and determine if the account event was logged. The information logged should, at a minimum, include enough detail to determine which account was modified and when. If the account modification event information was not logged, this is a finding.

Fix
Configure the application to write a log entry when a user account is modified. At a minimum, ensure account name, date and time of the event are recorded.
APSC-DV-000360 CAT II V-222415 · SRG-APP-000028

The application must automatically audit account disabling actions.

Maps to AC-2(4) via CCI-001404

Check
Examine the application documentation to identify how the application users are managed. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application. If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable. Identify the location of the audit logs and review the end of the logs. Access the user account management functionality and disable a test user account. Examine the log file again and determine if the account disable event was logged. The information logged should, at a minimum, include enough detail to determine which account was disabled and when. If the account disabling event information was not logged, this is a finding.

Fix
Configure the application to write a log entry when a user account is disabled. At a minimum, ensure account name, date and time of the event are recorded.
APSC-DV-000370 CAT II V-222416 · SRG-APP-000029

The application must automatically audit account removal actions.

Maps to AC-2(4) via CCI-001405

Check
Examine the application documentation to identify how the application users are managed. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application. If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable. Identify the location of the audit logs and review the end of the logs. Access the user account management functionality and remove a test user account. Examine the log file again and determine if the account removal event was logged. The information logged should, at a minimum, include enough detail to determine which account was disabled and when. If the account removal event information was not logged, this is a finding.

Fix
Configure the application to write a log entry when a user account is removed. At a minimum, ensure account name, date and time of the event are recorded.
APSC-DV-000420 CAT II V-222421 · SRG-APP-000319

The application must automatically audit account enabling actions.

Maps to AC-2(4) via CCI-002130

Check
Examine the application documentation or interview the application representative to identify how the application users are managed. Interview the application administrator and determine if the application is configured to utilize a centralized user management system such as Active Directory for user management or if the application manages user accounts within the application. If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable. Identify the location of the audit logs and review the end of the logs. Access the user account management functionality and enable a test user account. Examine the log file again and determine if the account enable event was logged. The information logged should, at a minimum, include enough detail to determine which account was enabled and when. If the account enabling event information was not logged, this is a finding.

Fix
Configure the application to write a log entry when a user account is enabled. At a minimum, ensure account name, date and time of the event are recorded.
APSC-DV-000440 CAT II V-222423 · SRG-APP-000323

Application data protection requirements must be identified and documented.

Maps to AC-23 via CCI-002346

Check
Ask the application representative for the documentation that identifies the application data elements, the protection requirements, and any associated steps that are being taken to protect the data. If the application data protection requirements are not documented, this is a finding.

Fix
Identify and document the application data elements and the data protection requirements.
APSC-DV-000450 CAT II V-222424 · SRG-APP-000324

The application must utilize organization-defined data mining detection techniques for organization-defined data storage objects to adequately detect data mining attempts.

Maps to AC-23 via CCI-002347

Check
Review the security plan, application and system documentation and interview the application administrator to identify data mining protections that are required of the application. If there are no data mining protections required, this requirement is not applicable. Review the application authentication requirements and permissions. Review documented protections that have been established to protect from data mining. This can include limiting the number of queries allowed. Automated alarming on atypical query events. Limiting the number of records allowed to be returned in a query. Not allowing data dumps. If the application requirements specify protections for data mining and the application administrator is unable to identify or demonstrate that the protections are in place, this is a finding.

Fix
Utilize and implement data mining protections when requirements specify it.
APSC-DV-000470 CAT II V-222426 · SRG-APP-000328

The application must enforce organization-defined discretionary access control policies over defined subjects and objects.

Maps to AC-3(4) via CCI-002165

Check
Review the application documentation and interview the application administrator. Review application data protection requirements and application integrated access control methods. Identify if the application implements discretionary access control to application resources. Discretionary Access Controls (DAC) allows application users to determine and set permissions on application data and application objects. The result is the user is given the ability to control who has access to the data they control. If the application does not implement discretionary access controls, this requirement is not applicable. Resources can be a URL, a folder, a file, a process, a database record, or any other application asset that warrants sharing or authorization permission reassignment. Create 3 test accounts. Using test account 1 set protection control on a test user 1 controlled resource. Grant access to test user 2 and only test user 2. Authenticate as test user 3 and attempt to access the application resource where test user 1 and test user 2 are granted access. Access should be denied. If the enforcement of configured access restrictions is not performed, this is a finding.

Fix
Design and configure the application to enforce discretionary access control policies.
APSC-DV-000480 CAT II V-222427 · SRG-APP-000038

The application must enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Maps to AC-4 via CCI-001368

Check
Review the application documentation and interview the application and system administrators. Review application features and functions to determine if the application is designed to control the flow of information within the system. Identify: - rulesets, - data labels, and - policies to determine if the application is designed to control the flow of data within the system. If the application does not provide data flow control capabilities, the requirement is not applicable. Access the system as a user with access rights that allow the creation of test data or use of existing test data. Create a test data set and label the data with a data label provided with or by the application, e.g., Personally Identifiable Information (PII) data. Review the policy to determine where in the system the PII labeled data is allowed and is not allowed to go. Using application features and functions, attempt to transmit the labeled data to an area that is prohibited by policy. Verify the flow control policy was enforced and the data was not transmitted. If the application does not enforce the approved authorizations for controlling data flow, this is a finding.

Fix
Configure the application to enforce data flow control in accordance with data flow control policies.
APSC-DV-000490 CAT II V-222428 · SRG-APP-000039

The application must enforce approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.

Maps to AC-4 via CCI-001414

Check
Review the application documentation and interview the application and system administrators. Identify application features and functions to determine if the application is designed to control the flow of information between interconnected systems. Identify: - rulesets, - data labels - policies - systems to determine if the application is designed to control the flow of data between interconnected systems. If the application does not provide data flow control capabilities, the requirement is not applicable. Access the system as a user with access rights allowing the creation of test data or use of existing test data. Create a test data set and label the data with a data label provided with or by the application (for example, a Personally Identifiable Information (PII) data label). Review the policy settings to determine where the PII labeled data is allowed and is not allowed. Using application features and functions, attempt to transmit the labeled data to an interconnected system that is prohibited by policy. Verify the flow control policy was enforced and the data was not transmitted. If the application does not enforce the approved authorizations for controlling data flow, this is a finding.

Fix
Configure the application to enforce data flow control in accordance with data flow control policies.
APSC-DV-000500 CAT II V-222429 · SRG-APP-000340

The application must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Maps to AC-6(10) via CCI-002235

Check
Identify the application user account(s) that the application uses to run. These accounts include the application processes (defined by Control Panel Services (Windows) or ps –ef (UNIX)) or for an n-tier application, the account that connects from one service (such as a web server) to another (such as a database server). Determine the OS user groups in which each account is a member. List the user rights assigned to these users and groups and evaluate whether any of them are unnecessary. If the OS rights exceed application operational requirements, this is a finding. If the application user account is a member of the Administrators group (Windows) or has a User Identification (UID) of 0 (i.e., is equivalent to root in UNIX), this is a finding. Search the file system to determine if the application user or groups have ownership or permissions to any files or directories. Review the list of files and identify any that are outside the scope of the application. If there are such files outside the scope of the application, this is a finding. Check ownership and permissions; identify permissions beyond the minimum necessary to support the application. If there are instances of unnecessary ownership or permissions, this is a finding. The finding details should note the full path of the file(s) and the associated issue (i.e., outside scope, permissions improperly granted to user X, etc.).

Fix
Modify the application to limit access and prevent the disabling or circumvention of security safeguards.
APSC-DV-000520 CAT II V-222431 · SRG-APP-000343

The application must audit the execution of privileged functions.

Maps to AC-6(9) via CCI-002234

Check
Log on to the application as an administrative user. Identify functionality within the application that requires utilizing the admin role. Monitor application logs while performing privileged functions within the application. Perform administrative types of tasks such as adding or modifying user accounts, modifying application configuration, or managing encryption keys. Review logs for entries that indicate the administrative actions performed were logged. Ensure the specific action taken, date and time or event is recorded. If the execution of privileged functionality is not logged, this is a finding.

Fix
Configure the application to write log entries when privileged functions are executed. At a minimum, ensure the specific action taken, date and time of event are recorded.
APSC-DV-000540 CAT II V-222433 · SRG-APP-000345

The application administrator must follow an approved process to unlock locked user accounts.

Maps to AC-7 via CCI-002238

Check
Interview the application administrator and identify the approved process for unlocking user accounts. The process may involve a manual or automated reset after the locked out user has identified themselves using standard user identification processes outlined in the vulnerability discussion. If the admin does not unlock the account following the approved process, and if the process does not have documented ISSO and ISSM approvals, this is a finding.

Fix
Create a standard approved process for unlocking locked application accounts which includes validating user identity prior to unlocking the account. Use that process when unlocking application user accounts.
APSC-DV-000590 CAT II V-222438 · SRG-APP-000080

The application must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.

Maps to AU-10 via CCI-000166

Check
Review the application documentation, the design requirements if available and interview the application administrator. Identify application services or application commands that are formerly required and designed to provide non-repudiation services (e.g., digital signatures). If the application documentation specifically states that non-repudiation services for application users are not defined as part of the application design, this requirement is not applicable. Email is one example of an application specifically required to provide non-repudiation services for application users within the DoW. Interview the application administrators and have them describe which aspect of the application, if any, is required to provide digital signatures. Access the application as a test user or observe the application administrator as they demonstrate the applications signature capabilities. If the application is required to provide non-repudiation services and does not, or if the non-repudiation functionality fails on demonstration, this is a finding.

Fix
Configure the application to provide users with a non-repudiation function in the form of digital signatures when it is required by the organization or by the application design and architecture.
APSC-DV-000600 CAT II V-222439 · SRG-APP-000086

For applications providing audit record aggregation, the application must compile audit records from organization-defined information system components into a system-wide audit trail that is time-correlated with an organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail.

Maps to AU-12(1) via CCI-000174

Check
Review the application documentation and interview the application administrator. Determine if the application has the ability to compile audit records from multiple systems or system components. If the application does not provide log aggregation services, this requirement is not applicable. Identify the systems that comprise the application. Access each system comprising the application or a random sample of several application systems. Review the application logs and obtain date and time stamps for several random audit events. Record the information. Access the server providing the log aggregation. Access the application logs that have been written to the server and compare the samples obtained from the application systems to the aggregated logs. Ensure the dates and time stamps correlate with one another. If the log dates and times do not correlate when the logs are aggregated, this is a finding.

Fix
Configure the application to correlate time stamps when aggregating audit records.
APSC-DV-000620 CAT II V-222441 · SRG-APP-000089

The application must provide audit record generation capability for the creation of session IDs.

Maps to AU-12 via CCI-000169

Check
Access the management interface for the application or configuration file and evaluate the log/audit management settings. Determine if the setting that enables session ID creation event auditing is activated. Create a new user session by logging in to the application. Review the logs to ensure the session creation event was recorded. If the application is not configured to log session ID creation events, or if no creation event was recorded, this is a finding. If a web-based application delegates session ID creation to an application server, this is not a finding. If the application generates session ID creation event logs by default, and that behavior cannot be disabled, this is not a finding.

Fix
Enable session ID creation event auditing.
APSC-DV-000630 CAT II V-222442 · SRG-APP-000089

The application must provide audit record generation capability for the destruction of session IDs.

Maps to AU-12 via CCI-000169

Check
Access the management interface for the application or configuration file and evaluate the log/audit management settings. Determine if the setting that enables session ID destruction event auditing is activated. Terminate a user session within the application and review the logs to ensure the session destruction event was recorded. If the application is not configured to log session ID destruction events, or if the application has no means to enable auditing of session ID destruction events, this is a finding. If a web-based application delegates session ID destruction to an application server, this is not a finding. If the application generates audit logs by default when session IDs are destroyed, and that behavior cannot be disabled, this is not a finding.

Fix
Enable session ID destruction event auditing.
APSC-DV-000640 CAT II V-222443 · SRG-APP-000089

The application must provide audit record generation capability for the renewal of session IDs.

Maps to AU-12 via CCI-000169

Check
Interview the system admin and review the application documentation. Identify any web pages or application functionality where a user's privileges or permissions will change. This is most likely to occur during the authentication stages. Evaluate the log/audit output by opening the log files and observing changes to the logs. Create a new user session by accessing the application. Review the logs and save the relevant session creation event recorded. Utilize the application pages that provide privilege escalation. Escalate privileges by authenticating as a privileged user. Review the logs and determine if new session information is created and being used. If a web-based application delegates session ID renewals to an application server, this is not a finding. If the application is not configured to log session ID renewal events this is a finding.

Fix
Design or reconfigure the application to log session renewal events on those application events that provide changes in the users privileges or permissions to the application.
APSC-DV-000650 CAT II V-222444 · SRG-APP-000089

The application must not write sensitive data into the application logs.

Maps to AU-12 via CCI-000169

Check
Review the application logs and identify application logging format. Using the format of the log and the requisite search data as a guide to create your search, create search strings that could successfully identify the existence of passwords, session IDs, or other sensitive information such as SSN. Utilizing the UNIX grep-based search utility include the following examples which are meant to illustrate the purpose of the requirement. Password values are usually associated with usernames so searching for "username" in the provided log file will often assist in determining if password values are included. grep -i "username" < logfile.txt Search for social security numbers in the provided log file. grep -i "[0-9]{3}[-]?[0-9]{2}[-]?[0-9]{4}" < logfile.txt Use regular expressions to aid in searching log files. All search syntax cannot be provided within the STIG, the reviewer must utilize their knowledge to create new search criteria based upon the log format used and the potentially sensitive data processed by the application. If the application logs sensitive data such as session IDs, application source code, encryption keys, or passwords, this is a finding.

Fix
Design or reconfigure the application to not write sensitive data to the logs.
APSC-DV-000660 CAT II V-222445 · SRG-APP-000089

The application must provide audit record generation capability for session timeouts.

Maps to AU-12 via CCI-000169

Check
Review the application documentation and interview the application administrator to identify log locations for application session activity. Open the log file that tracks user session activity. Access the application as a regular user and identify the user session within the log files. Identify the session timeout threshold defined by the application. Perform no action within the application in order to allow the session to timeout. Once the session timeout threshold has been exceeded, verify the session has been terminated due to the timeout event and review the logs again to ensure the session timeout event was recorded in the logs. If a web-based application delegates session timeout auditing to an application server, this is not a finding. If the session timeout event is not recorded in the logs, this is a finding.

Fix
Configure the application to record session timeout events in the logs.
APSC-DV-000670 CAT II V-222446 · SRG-APP-000089

The application must record a time stamp indicating when the event occurred.

Maps to AU-12 via CCI-000169

Check
Review the application logs. If the time the event occurred is not included as part of the event, this is a finding.

Fix
Configure the application to record the time the event occurred when recording the event.
APSC-DV-000680 CAT II V-222447 · SRG-APP-000089

The application must provide audit record generation capability for HTTP headers including User-Agent, Referer, GET, and POST.

Maps to AU-12 via CCI-000169

Check
Review the application documentation and interview the application administrator to identify log locations for application session activity. Open the log file that tracks user session activity. Access the application as a regular user and identify the user session within the log files. Perform several actions within the application in order to generate HTTP header traffic. Review the logs to ensure the HTTP header information is recorded in the logs. Header information logged will vary based upon the application and environment. Examples of headers include but are not limited to: User-Agent: Referer: X-Forwarded-For: Date: Expires: If HTTP headers are not logged, this is a finding.

Fix
Configure the web application and/or the web server to log HTTP headers.
APSC-DV-000690 CAT II V-222448 · SRG-APP-000089

The application must provide audit record generation capability for connecting system IP addresses.

Maps to AU-12 via CCI-000169

Check
Review the application documentation and interview the application administrator to identify where audit logs are stored. Review audit logs and determine if the IP address information of systems that connect to the application is kept in the logs. If connecting IP addresses are not seen in the logs, connect to the application remotely and review the logs to determine if the connection was logged. If the IP addresses of the systems that connect to the application are not recorded in the logs, this is a finding.

Fix
Configure the application or application server to log all connecting IP address information
APSC-DV-000700 CAT II V-222449 · SRG-APP-000089

The application must record the username or user ID of the user associated with the event.

Maps to AU-12 via CCI-000169

Check
Review and monitor the application logs. Connect to the application and perform application activity that is allowed by the user such as accessing data or running reports. Observe if the log includes an entry to indicate the user ID of the user that conducted the activity. If the user ID is not recorded along with the event in the event log, this is a finding.

Fix
Configure the application to record the user ID of the user responsible for the log event entry.
APSC-DV-000710 CAT II V-222450 · SRG-APP-000091

The application must generate audit records when successful/unsuccessful attempts to grant privileges occur.

Maps to AU-12 via CCI-000172

Check
Review the application documentation and interview the application admin to identify application management interfaces and features. Access the application management utility and create a test user account or use the account of a regular unprivileged user who is cooperating with the testing. Access and open the auditing logs. Using an account with the appropriate privileges, grant the user a privilege they previously did not have. Attempt to grant privileges in a manner that will cause a failure event such as granting privileges to a non-existent user or attempting to grant privileges with an account that doesn't have the rights to do so. Review the application logs and ensure both events were captured in the logs. The event data should include the user’s identity and the privilege that was granted and the privilege that failed to be granted. If the application does not log when successful and unsuccessful attempts to grant privilege occur, this is a finding.

Fix
Configure the application to audit successful and unsuccessful attempts to grant privileges.
APSC-DV-000720 CAT II V-222451 · SRG-APP-000492

The application must generate audit records when successful/unsuccessful attempts to access security objects occur.

Maps to AU-12 via CCI-000172

Check
Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify application functionality that provides privilege or permission settings to security objects within the application. This can be an application function that assigns privileges to an application object or data element. Authenticate to the application as a regular user. Using application functionality, attempt to access the security object within the application. Perform two attempts, one successfully and one unsuccessfully. Review the log data and ensure both the successful and unsuccessful access attempts are logged. If the application does not generate an audit record when successful and unsuccessful attempts to access security objects occur, this is a finding.

Fix
Configure the application to create an audit record for both successful and unsuccessful attempts to access security objects.
APSC-DV-000730 CAT II V-222452 · SRG-APP-000493

The application must generate audit records when successful/unsuccessful attempts to access security levels occur.

Maps to AU-12 via CCI-000172

Check
Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify application functionality that provides privilege escalation or access to additional security levels within the application. This can be performing a function that escalates the privileges of the user, or accessing a protected area of the application that requires additional authentication in order to access. Authenticate to the application as a regular user. Using application functionality, attempt to access a different security level or domain within the application. Perform two attempts, one successfully and one unsuccessfully. Review the log data and ensure both the successful and unsuccessful access attempts are logged. If the application does not generate an audit record when successful and unsuccessful attempts to access security levels occur, this is a finding.

Fix
Configure the application to create an audit record for both successful and unsuccessful attempts to access security levels.
APSC-DV-000740 CAT II V-222453 · SRG-APP-000494

The application must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur.

Maps to AU-12 via CCI-000172

Check
Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify any data protections that are required. Identify any categories of data or classification of data. If the application requirements do not call for compartmentalized data and data protection, this requirement is not applicable. Authenticate to the application as a regular user. Using application functionality, attempt to access data that has been assigned to a protected category. Perform two access attempts, one successful and one unsuccessful. Testing this will require obtaining access to test data that has been assigned to a protected category, or having an authorized user access the data for you. Review the log data and ensure both the successful and unsuccessful access attempts are logged. If the application does not generate an audit record when successful and unsuccessful attempts to access categories of information occur, this is a finding.

Fix
Configure the application to create an audit record for both successful and unsuccessful attempts to access protected categories of information.
APSC-DV-000750 CAT II V-222454 · SRG-APP-000495

The application must generate audit records when successful/unsuccessful attempts to modify privileges occur.

Maps to AU-12 via CCI-000172

Check
Review the application documentation and interview the application admin to identify application management interfaces and features. Access the application management utility and create a test user account or use the account of a regular privileged user who is cooperating with the testing. Access and open the auditing logs. Using an admin account, modify the privileges of a privileged user. Attempt to modify privileges in a manner that will cause a failure event such as attempting to modify a user’s privileges with an account that doesn't have the rights to do so. Review the application logs and ensure both events were captured in the logs. The event data should include the user’s identity and the privilege that was granted and the privilege that failed to be granted. If the application does not log when successful and unsuccessful attempts to modify privileges occur, this is a finding.

Fix
Configure the application to audit successful and unsuccessful attempts to modify privileges.
APSC-DV-000760 CAT II V-222455 · SRG-APP-000496

The application must generate audit records when successful/unsuccessful attempts to modify security objects occur.

Maps to AU-12 via CCI-000172

Check
Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify application functionality that provides privilege or permission settings to security objects within the application. This can be an application function that assigns privileges to an application object or data element. Authenticate to the application as a regular user. Using application functionality, attempt to modify the security object within the application. Perform two attempts, one successfully and one unsuccessfully. Review the log data and ensure the modification events both successful and unsuccessful are logged. If the application does not generate an audit record when successful and unsuccessful attempts to modify security objects occur, this is a finding.

Fix
Configure the application to create an audit record for both successful and unsuccessful attempts to modify security objects.
APSC-DV-000770 CAT II V-222456 · SRG-APP-000497

The application must generate audit records when successful/unsuccessful attempts to modify security levels occur.

Maps to AU-12 via CCI-000172

Check
Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify application functionality that provides privilege escalation or access to additional security levels within the application. This can be performing a function that escalates the privileges of the user, or accessing a protected area of the application that requires additional authentication in order to access. Authenticate to the application as a regular user. Using application functionality, attempt to modify the permissions of a different security level or domain within the application. Perform two attempts, one successfully and one unsuccessfully. Review the log data and ensure the modify events, both successful and unsuccessful, are logged. If the application does not generate an audit record when successful and unsuccessful attempts to modify the permissions regarding the security levels occur, this is a finding.

Fix
Configure the application to create an audit record for both successful and unsuccessful attempts to modify security levels.
APSC-DV-000780 CAT II V-222457 · SRG-APP-000498

The application must generate audit records when successful/unsuccessful attempts to modify categories of information (e.g., classification levels) occur.

Maps to AU-12 via CCI-000172

Check
Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify any data protections that are required. Identify any categories of data or classification of data. If the application requirements do not call for compartmentalized data and data protection, this requirement is not applicable. Authenticate to the application as a regular user. Using application functionality, attempt to modify data that has been assigned to a protected category. Perform two modification attempts, one successful and one unsuccessful. Testing this will require obtaining access to test data that has been assigned to a protected category, or having an authorized user access the data for you. Review the log data and ensure both the successful and unsuccessful modification attempts are logged. If the application does not generate an audit record when successful and unsuccessful attempts to modify categories of information occur, this is a finding.

Fix
Configure the application to create an audit record for both successful and unsuccessful attempts to modify protected categories of information.
APSC-DV-000790 CAT II V-222458 · SRG-APP-000499

The application must generate audit records when successful/unsuccessful attempts to delete privileges occur.

Maps to AU-12 via CCI-000172

Check
Review the application documentation and interview the application admin to identify application management interfaces and features. Access the application management utility and create a test user account or use the account of a regular privileged user who is cooperating with the testing. Access and open the auditing logs. Using an admin account, delete some or all of the privileges of a privileged user. Attempt to delete privileges in a manner that will cause a failure event such as attempting to delete a user’s privileges with an account that doesn't have the rights to do so. Review the application logs and ensure both events were captured in the logs. The event data should include the user’s identity and the privilege that was granted and the privilege that failed to be granted. If the application does not log when successful and unsuccessful attempts to delete privileges occur, this is a finding.

Fix
Configure the application to audit successful and unsuccessful attempts to delete privileges.
APSC-DV-000800 CAT II V-222459 · SRG-APP-000500

The application must generate audit records when successful/unsuccessful attempts to delete security levels occur.

Maps to AU-12 via CCI-000172

Check
Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify application functionality that provides privilege escalation or access to additional security levels within the application. This can be performing a function that escalates the privileges of the user, or accessing a protected area of the application that requires additional authentication in order to access. Authenticate to the application as a regular user. Using application functionality, attempt to delete permissions of a different security level or domain within the application. Perform two attempts, one successfully and one unsuccessfully. Review the log data and ensure the deletion events, both successful and unsuccessful are logged. If the application does not generate an audit record when successful and unsuccessful attempts to delete permissions regarding the security levels occur, this is a finding.

Fix
Configure the application to create an audit record for both successful and unsuccessful attempts to delete security levels.
APSC-DV-000810 CAT II V-222460 · SRG-APP-000501

The application must generate audit records when successful/unsuccessful attempts to delete application database security objects occur.

Maps to AU-12 via CCI-000172

Check
Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify application functionality that provides privilege or permission settings to database security objects within the application. This can be an application function that assigns privileges to an application object or data element. Authenticate to the application as a regular user. Using application functionality, attempt to delete the database security object within the application. Perform two attempts, one successfully and one unsuccessfully. Review the log data and ensure the deletion events, both successful and unsuccessful, are logged. If the application does not generate an audit record when successful and unsuccessful attempts to delete database security objects occur, this is a finding.

Fix
Configure the application to create an audit record for both successful and unsuccessful attempts to delete database security objects.
APSC-DV-000820 CAT II V-222461 · SRG-APP-000502

The application must generate audit records when successful/unsuccessful attempts to delete categories of information (e.g., classification levels) occur.

Maps to AU-12 via CCI-000172

Check
Review the application documentation and interview the application administrator. Identify where the application logs are stored. Identify any data protections that are required. Identify any categories of data or classification of data. If the application requirements do not call for compartmentalized data and data protection, this requirement is not applicable. Authenticate to the application as a regular user. Using application functionality, attempt to delete data that has been assigned to a protected category. Perform two modification attempts, one successful and one unsuccessful. Testing this will require obtaining access to test data that has been assigned to a protected category, or having an authorized user access the data for you. Review the log data and ensure both the successful and unsuccessful deletion attempts are logged. If the application does not generate an audit record when successful and unsuccessful attempts to delete categories of information occur, this is a finding.

Fix
Configure the application to create an audit record for both successful and unsuccessful attempts to delete protected categories of information.
APSC-DV-000830 CAT II V-222462 · SRG-APP-000503

The application must generate audit records when successful/unsuccessful logon attempts occur.

Maps to AU-12 via CCI-000172

Check
Review and monitor the application logs. Authenticate to the application and observe if the log includes an entry to indicate the user’s authentication was successful. Terminate the user session by logging out. Reauthenticate using invalid user credentials and observe if the log includes an entry to indicate the authentication was unsuccessful. If successful and unsuccessful logon events are not recorded in the logs, this is a finding.

Fix
Configure the application or application server to write a log entry when successful and unsuccessful logon events occur.
APSC-DV-000840 CAT II V-222463 · SRG-APP-000504

The application must generate audit records for privileged activities or other system-level access.

Maps to AU-12 via CCI-000172

Check
Review and monitor the application logs. Authenticate to the application as a privileged user and observe if the log includes an entry to indicate the user’s authentication was successful. Perform actions as an admin or other privileged user such as modifying the logging verbosity, or starting or stopping an application service, or terminating a test user session. If log events that correspond with the actions performed are not recorded in the logs, this is a finding.

Fix
Configure the application to write a log entry when privileged activities or other system-level events occur.
APSC-DV-000850 CAT II V-222464 · SRG-APP-000505

The application must generate audit records showing starting and ending time for user access to the system.

Maps to AU-12 via CCI-000172

Check
Review and monitor the application logs. Initiate a user session and observe if the log includes a time stamp showing the start of the session. Terminate the user session and observe if the log includes a time stamp showing the end of the session. If the start and the end time of the session are not recorded in the logs, this is a finding.

Fix
Configure the application or application server to record the start and end time of user session activity.
APSC-DV-000860 CAT II V-222465 · SRG-APP-000507

The application must generate audit records when successful/unsuccessful accesses to objects occur.

Maps to AU-12 via CCI-000172

Check
Review the application documentation and interview the application administrator to identify log locations. Access the application logs. Review the logs and identify if the application is logging both successful and unsuccessful access to application objects such as files, folders, processes, or application modules and sub components, or systems. If the application does not log application object access, this is a finding.

Fix
Configure the application to log successful and unsuccessful access to application objects.
APSC-DV-000870 CAT II V-222466 · SRG-APP-000508

The application must generate audit records for all direct access to the information system.

Maps to AU-12 via CCI-000172

Check
Review the application documentation and interview the application administrator. Identify if the application implements a direct access feature or function that allows users to directly access the underlying OS. Direct access includes but is not limited to: executing OS commands, navigating the file system, manipulating system resources such as print queues, or reading files hosted on the OS that are not specifically shared or made available on the website. If the application does not provide direct access to the system, this requirement is not applicable. Access the application logs. Access the application as a user or test user with appropriate permissions and attempt to execute application features and functions that provide direct access to the system. Review the logs and ensure the actions executed were logged. Log information must include the user responsible for executing the action, the action executed, and the result of the action. If the application does not log all direct access to the system, this is a finding.

Fix
Configure the application to log all direct access to the system.
APSC-DV-000880 CAT II V-222467 · SRG-APP-000509

The application must generate audit records for all account creations, modifications, disabling, and termination events.

Maps to AU-12 via CCI-000172

Check
Examine the application documentation or interview the application representative to identify how the application users are managed. Interview the application administrator and determine if the application is configured to utilize a centralized user management system such as Active Directory for user management or if the application manages user accounts within the application. If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable. Identify the location of the audit logs and review the end of the logs. Access the user account management functionality. Create an application test account and then review the log to ensure a log record that documents the event is created. Modify the test account and then review the log to ensure a log record that documents the event is created. Disable the test account and then review the log to ensure a log record that documents the event is created. Terminate/remove the test account and then review the log to ensure a log record that documents the event is created. If log events are not created that document all of these events, this is a finding. If some but not all of the aforementioned events are documented in the logs, this is a finding. Findings should document which of the events was not logged.

Fix
Configure the application to log user account creation, modification, disabling, and termination events.
APSC-DV-000910 CAT II V-222468 · SRG-APP-000092

The application must initiate session auditing upon startup.

Maps to AU-14(1) via CCI-001464

Check
Examine the application design documentation and interview the application administrator to identify application logging behavior. If the application is writing to an existing log or log file: Open and monitor the application log. Start the application service and view the log entries. Log entries indicating the application is starting should commence as soon as the application starts. Determine if the log events correlate with the time the application was started and if event log entries include an application start up sequence of events. If the application writes events to a new log on startup: Identify location logs are written to, start the application and then identify and access the new log. Determine if the log events correlate with the time the application was started and if event log entries include an application start up sequence of events. If the application does not begin logging events upon start up, this is a finding.

Fix
Configure the application to begin logging application events as soon as the application starts up.
APSC-DV-000940 CAT II V-222469 · SRG-APP-000095

The application must log application shutdown events.

Maps to AU-3 via CCI-000130

Check
Review and monitor the application and system logs. If an application shutdown event is not recorded in the logs, either initiate a shutdown event and review the logs after reestablishing access or request backup copies of the application or system logs that indicate shutdown events are being recorded. Alternatively, check for a setting within the application that controls application logging events and determine if application shutdown logging is configured. If the application is not recording application shutdown events in either the application or system log, or if the application is not configured to record shutdown events, this is a finding.

Fix
Configure the application or application server to record application shutdown events in the event logs.
APSC-DV-000950 CAT II V-222470 · SRG-APP-000095

The application must log destination IP addresses.

Maps to AU-3 via CCI-000130

Check
If the application design documentation indicates the application does not initiate connections to remote systems this requirement is not applicable. Network connections to systems used for support services such as DNS, AD, or LDAP may be stored in the system logs. These connections are applicable. Identify log source based upon application architecture, design documents and input from application admin. Review and monitor the application or system logs. Connect to the application and utilize the application functionality that initiates connections to a destination system. If the application routinely connects to remote system on a regular basis you may simply allow the application to operate in the background while the logs are observed. Observe the log activity and determine if the log includes an entry to indicate the IP address of the destination system. If the IP address of the remote system is not recorded along with the event in the event log, this is a finding.

Fix
Configure the application to record the destination IP address of the remote system.
APSC-DV-000960 CAT II V-222471 · SRG-APP-000095

The application must log user actions involving access to data.

Maps to AU-3 via CCI-000130

Check
Review and monitor the application logs. When accessing data, the logs are most likely database logs. If the application design documents include specific data elements that require protection, ensure user access to those data elements are logged. Utilize the application as a regular user and operate the application so as to access data elements contained within the application. This includes using the application user interface to browse through data elements, query/search data elements and using report generation capability if it exists. Observe and determine if the application log includes an entry to indicate the user’s access to the data was recorded. If successful access to application data elements is not recorded in the logs, this is a finding.

Fix
Identify the specific data elements requiring protection and audit access to the data.
APSC-DV-000970 CAT II V-222472 · SRG-APP-000095

The application must log user actions involving changes to data.

Maps to AU-3 via CCI-000130

Check
Review and monitor the application logs. When modifying data, the logs are most likely database logs. If the application design documents include specific data elements that require protection, ensure any changes to those specific data elements are logged. Otherwise, a random check is sufficient. If the application uses a database configured to use Transaction SQL logging this is not a finding if the application admin can demonstrate a process for reviewing the transaction log for data changes. The process must include using the transaction log and some form of query capability to identify users and the data they changed within the application and vice versa. Utilize the application as a regular user and operate the application so as to modify a data element contained within the application. Observe and determine if the application log includes an entry to indicate the users data change event was recorded. If successful changes/modifications to application data elements are not recorded in the logs, this is a finding.

Fix
Configure the application to log all changes to application data.
APSC-DV-000980 CAT II V-222473 · SRG-APP-000096

The application must produce audit records containing information to establish when (date and time) the events occurred.

Maps to AU-3 via CCI-000131

Check
Access the application logs and review the log entries for date and time. Each event written into the log must have a corresponding date and time stamp associated with it. If the audit logs do not have a corresponding date and time associated with each event, this is a finding.

Fix
Configure the application or application server to include the date and the time of the event in the audit logs.
APSC-DV-000990 CAT II V-222474 · SRG-APP-000097

The application must produce audit records containing enough information to establish which component, feature or function of the application triggered the audit event.

Maps to AU-3 via CCI-000132

Check
Review application administration and/or design documents. Identify key aspects of application architecture objects and components, e.g., Web Server, Application server, Database server. Interview the application administrator and identify the log locations. Access the application logs and review the log entries for events that indicate the application is auditing the internal components, objects, or functions of the application. Confirm the event logs provide information as to which component, feature, or functionality of the application triggered the event. Examples of the types of events to look for are as follows: - Application and Protocol events. e.g., Application loads or unloads and Protocol use. - Data Access events. e.g., Database connections. Events could include reference to database library or executable initiating connectivity: - Middleware events. e.g., Source code initiating calls or being invoked. - Name of application modules being loaded or unloaded. - Library loads and unloads. - Application deployment activity. Events written into the log must be able to be traced back to the originating component, feature or function name, service name, application name, library name etcetera in order to establish which aspect of the application triggered the event. If the audit logs do not contain enough data in the logs to establish which component, feature or functionality of the application triggered the event, this is a finding.

Fix
Configure the application to log which component, feature or functionality of the application triggered the event.
APSC-DV-001000 CAT II V-222475 · SRG-APP-000098

When using centralized logging; the application must include a unique identifier in order to distinguish itself from other application logs.

Maps to AU-3 via CCI-000133

Check
If the application is logging locally and does not utilize a centralized logging solution, this requirement is not applicable. Review system documentation and identify log location. Access the application logs. Review the application logs. Ensure the application is uniquely identified either within the logs themselves or via log storage mechanisms. Ensure the hosts or client names hosting the application are also identified. Either hostname or IP address is acceptable. If the application name and the hosts or client names are not identified, this is a finding.

Fix
Configure the application logs or the centralized log storage facility so the application name and the hosts hosting the application are uniquely identified in the logs.
APSC-DV-001010 CAT II V-222476 · SRG-APP-000099

The application must produce audit records that contain information to establish the outcome of the events.

Maps to AU-3 via CCI-000134

Check
Review system and application documentation to identify application operation and function. Access the application logs and review the logs to determine if the results of application operations are logged. Successful application events are expected to far outnumber errors. Therefore, success events may be implied by default and not specified in the logs if this behavior is documented. The outcome will be a log record that displays the application event/operation that occurred followed by the result of the operation such as "ERROR", "FAILURE", "SUCCESS" or "PASS". Operation outcomes may also be indicated by numeric code where a "1" might indicate success and a "0" may indicate operation failure. If the application does not produce audit records that contain information regarding the results of application operations, this is a finding.

Fix
Configure the application to include the outcome of application functions or events.
APSC-DV-001020 CAT II V-222477 · SRG-APP-000100

The application must generate audit records containing information that establishes the identity of any individual or process associated with the event.

Maps to AU-3 via CCI-001487

Check
Review system documentation and discuss application operation with application administrator. Identify application processes and application users. Identify application components, e.g., application features framework and function. Identify server components, such as web server, database server. Review application logs. Ensure the application event logs include an identifier or identifiers that will allow an investigator to determine the user or the application process responsible for the application event. If the event logs do not include the appropriate identifier or identifiers, this is a finding.

Fix
Configure the application to log the identity of the user and/or the process associated with the event.
APSC-DV-001030 CAT II V-222478 · SRG-APP-000101

The application must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users.

Maps to AU-3(1) via CCI-000135

Check
Review application documentation and interview application administrator. Identify audit log locations and review audit logs. Access the system as a privileged user and execute privileged commands. Review the application logs and ensure that the logs contain all details of the actions performed. If a privileged command was typed within the application that command text must be included in the logs. Authentication information provided as part of the text must NOT be logged, just the commands. If an action was performed, such as activating a check box, that action must be logged. Review group account users, review logs to determine if the individual users of group accounts are identified in the logs. If the application does not log the full text recording of privileged commands or if the application does not identify and log the individuals associated with group accounts, this is a finding.

Fix
Configure the application to log the full text recording of privileged commands or the individual identities of group users.
APSC-DV-001040 CAT II V-222479 · SRG-APP-000101

The application must implement transaction recovery logs when transaction based.

Maps to AU-3(1) via CCI-000135

Check
Review the application documentation and interview the application administrator. Have the application administrator provide configuration settings that demonstrate transaction logging is enabled. Review configuration settings for the location of transaction specific logs and verify transaction logs exist and the log records access and changes to the data. If the application is not configured to utilize transaction logging, this is a finding.

Fix
Configure the application database to utilize transactional logging.
APSC-DV-001050 CAT II V-222480 · SRG-APP-000356

The application must provide centralized management and configuration of the content to be captured in audit records generated by all application components.

Maps to AU-6(4) via CCI-000154

Check
Review the application documentation and interview the application administrator to determine the logging architecture of the application. If the application is configured to log application event entries to a centralized, enterprise based logging solution that meets this requirement, this requirement is Not Applicable. Review the application components and the log management capabilities of the application. Verify the application log management interface includes the ability to centrally manage the configuration of what is captured in the logs of all application components. If the application does not provide the ability to centrally manage the content captured in the audit logs, this is a finding.

Fix
Configure the application to utilize a centralized log management system that provides the capability to configure the content of audit records.
APSC-DV-001070 CAT II V-222481 · SRG-APP-000358

The application must off-load audit records onto a different system or media than the system being audited.

Maps to AU-4(1) via CCI-001851

Check
Review application documentation and interview application administrator. Identify log functionality and locations of log files. Obtain risk acceptance documentation and task scheduling information. If the application is configured to utilize a centralized logging solution, this requirement is not applicable. Evaluate log management processes and determine if there are automated tasks that move the logs off of the system hosting the application. Verify automated tasks are performed on an ISSO approved schedule (hourly, daily etc.). Automation can be via scripting, log management oriented tools or other automated means. Review risk acceptance documentation for not utilizing a centralized logging solution. If the logs are not automatically moved off the system as per approved schedule, or if there is no formal risk acceptance documentation, this is a finding.

Fix
Configure the application to off-load audit records onto a different system as per approved schedule.
APSC-DV-001080 CAT II V-222482 · SRG-APP-000515

The application must be configured to write application logs to a centralized log repository.

Maps to AU-4(1) via CCI-001851

Check
Review application documentation and interview application administrator. Evaluate application log management processes and determine if the system is configured to utilize a centralized log management system for the hosting and management of application audit logs. If the system is not configured to write the application logs to the centralized log management repository in an expeditious manner, this is a finding.

Fix
Configure the application to utilize a centralized log repository and ensure the logs are off-loaded from the application system as quickly as possible.
APSC-DV-001090 CAT II V-222483 · SRG-APP-000359

The application must provide an immediate warning to the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.

Maps to AU-5(1) via CCI-001855

Check
Review system documentation and interview application administrator for details regarding logging configuration. If the application utilizes a centralized logging system that provides storage capacity alarming, this requirement is not applicable. Identify application alarming capability relating to storage capacity alarming for the log repository. Coordinate with the appropriate personnel regarding the generation of test alarms. Review log alarm settings and ensure audit log storage capacity alarming is enabled and set to alarm when the storage threshold exceeds 75% of disk storage capacity or the capacity value the SA and ISSO have determined will provide adequate time to plan for capacity expansion. Ensure the alarm will be sent to the ISSO and the application administrator when the utilization threshold is exceeded by changing the threshold settings to below the current disk space utilization. An alarm should be triggered at that point and forwarded to the ISSO and the SA/application admin. If the application is not configured to send an alarm when storage volume exceeds 75% of disc capacity or if the designated alarm recipients did not receive an alarm when the test was conducted, this is a finding.

Fix
Configure the application to send an immediate alarm to the application admin/SA and the ISSO when the allocated log storage capacity exceeds 75% of usage or exceeds the capacity value the SA and ISSO have determined will provide adequate time to plan for capacity expansion.
APSC-DV-001100 CAT II V-222484 · SRG-APP-000360

Applications categorized as having a moderate or high impact must provide an immediate real-time alert to the SA and ISSO (at a minimum) for all audit failure events.

Maps to AU-5(2) via CCI-001858

Check
Review system documentation and interview application administrator for details regarding application security categorization and logging configuration. If the application utilizes a centralized logging system that provides the real-time alarms, this requirement is not applicable. Review application log alert configuration. Identify audit failure events and associated alarming configuration. If the application is categorized as having a moderate or high impact and is not configured to provide a real-time alert that indicates the audit system has failed or is failing, this is a finding.

Fix
Configure the log alerts to send an alarm when the audit system is in danger of failing or has failed. Configure the log alerts to be immediately sent to the application admin/SA and ISSO.
APSC-DV-001110 CAT II V-222485 · SRG-APP-000108

The application must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.

Maps to AU-5 via CCI-000139

Check
Review system documentation and interview application administrator for details regarding logging configuration. If the application utilizes a centralized logging system that provides the audit processing failure alarms, this requirement is not applicable. Identify application alarming capability regarding audit processing failure events. Verify the application is configured to alarm when the auditing system fails. Example alarm events include but are not limited to: hardware failure events failures to capture audit record events audit storage errors If the application is not configured to alarm on alerts that indicate the audit system has failed or is failing, this is a finding.

Fix
Configure the application to send an alarm in the event the audit system has failed or is failing.
APSC-DV-001120 CAT II V-222486 · SRG-APP-000109

The application must shut down by default upon audit failure (unless availability is an overriding concern).

Maps to AU-5 via CCI-000140

Check
Review system documentation and interview application administrator for details regarding logging configuration. Identify application shut down capability regarding audit processing failure events. Locate and verify application logging settings that specify the application will halt processing on detected audit failure. If ISSO approval to continue operating and not shut down the application upon an audit failure exists and is documented, validate the application is configured as follows: If logging locally and the failure is attributed to a lack of disk space: Ensure the application is configured to overwrite the oldest logs first so as to maintain the most up to date audit events in the event of an audit failure. When logging centrally: Ensure the application is configured to locally spool/queue audit events in the event an audit failure is detected with the centralized system. If the application does not shut down processing when an audit failure is detected, or if the application does not take steps needed to ensure audit events are not lost due to audit failure, this is a finding.

Fix
Configure the application to cease processing if the audit system fails or configure the application to continue logging in a manner that compensates for the audit failure.
APSC-DV-001130 CAT II V-222487 · SRG-APP-000111

The application must provide the capability to centrally review and analyze audit records from multiple components within the system.

Maps to AU-6(4) via CCI-000154

Check
Review system documentation and interview application administrator for details regarding application architecture and logging configuration. Identify the application components, the logs that are associated with the components and the locations of the logs. If the application utilizes a centralized logging system that provides the capability to review the log files from one central location, this requirement is not applicable. Access the application's log management utility and review the log files. Ensure all of the applications logs are reviewable from within the centralized log management function and access to other systems in order to review application logs are not required. If all of the application logs are not reviewable from a central location, this is a finding.

Fix
Configure the application so all of the applications logs are available for review from one centralized location.
APSC-DV-001140 CAT II V-222488 · SRG-APP-000115

The application must provide the capability to filter audit records for events of interest based upon organization-defined criteria.

Maps to AU-7(1) via CCI-000158

Check
Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components as well as the locations of the logs. If the application utilizes a centralized logging system that provides the capability to filter log events based upon the following events, this requirement is not applicable. Review the application log management utility. Ensure the application provides the ability to filter on audit events based upon the following minimum criteria: Users: e.g., specific users or groups Event types: Event dates and time: System resources involved: e.g., application components or modules. IP addresses: Information objects accessed: Event level categories: e.g., high, critical, warning, error Key words: e.g., a specific search string Additional details may be logged as needed or prescribed by operational requirements. If the application does not provide the ability to filter audit events, this is a finding.

Fix
Configure the application filters to search event logs based on defined criteria.
APSC-DV-001150 CAT II V-222489 · SRG-APP-000181

The application must provide an audit reduction capability that supports on-demand reporting requirements.

Maps to AU-7 via CCI-001876

Check
Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components. If the application utilizes a centralized logging system that provides the capability to generate reports based on filtered log events, this requirement is not applicable. Using the relevant application features for generating reports and/or searching application data, (this is usually executed directly within a logging utility or within a reports feature or function) configure a filter based on any of the security criteria provided below. Alternatively, you can use security-oriented criteria provided by the application administrator. Once the data filter has been selected, filter the audit event data so only filtered data is displayed and generate the report. The report can be any combination of screen-based, soft copy, or a printed report. Criteria: Users: e.g., specific users or groups Event types: Event dates and time: System resources involved: e.g., application components or modules. IP addresses: Information objects accessed: Event level categories: e.g., high, critical, warning, error If the application does not provide on demand reports based on the filtered audit event data, this is a finding.

Fix
Configure the application to generate soft copy, hard copy and/or screen-based reports based on the selected filtered event data.
APSC-DV-001160 CAT II V-222490 · SRG-APP-000364

The application must provide an audit reduction capability that supports on-demand audit review and analysis.

Maps to AU-7 via CCI-001875

Check
Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components. If the application utilizes a centralized logging system that provides the capability to generate reports based on filtered log events, this requirement is not applicable. Using the relevant application features for generating reports and/or searching application data, (this is usually executed directly within a logging utility or within a reports feature or function) configure a filter based on any of the security criteria provided below. Alternatively, you can use security-oriented criteria provided by the application administrator. Once the data filter has been selected, filter the audit event data so only filtered data is displayed and generate the report. The report can be any combination of screen-based, soft copy, or a printed report. Criteria: Users: e.g., specific users or groups Event types: Event dates and time: System resources involved: e.g., application components or modules. IP addresses: Information objects accessed: Event level categories: e.g., high, critical, warning, error If the application does not provide an audit reduction capability that supports on-demand reports based on the filtered audit event data, this is a finding.

Fix
Configure the application to log to a centralized auditing capability that provides on-demand reports based on the filtered audit event data or design or configure the application to meet the requirement.
APSC-DV-001170 CAT II V-222491 · SRG-APP-000365

The application must provide an audit reduction capability that supports after-the-fact investigations of security incidents.

Maps to AU-7 via CCI-001877

Check
Review application documentation and interview application administrator for details regarding audit reduction (log record event filtering). Access the application with user rights sufficient to read and filter audit records. Navigate the application user interface and select the application functionality that provides access and interface to audit records and audit reduction (event filtering). If the application uses a centralized logging solution that performs the audit reduction (event filtering) functions, the requirement is not applicable. Examine the log files; take note of dates and times of events such as logon events. Note: dates and times as well as the original content and any unique record identifiers. Record the identifying information as well as the dates and times and content of the audit records. Apply filters to reduce the amount of audit records displayed to just the logon events for the day. Review the records and ensure the application provides the ability to filter on audit events. If the application does not provide an audit reduction (event filtering) capability, this is a finding.

Fix
Configure the application to provide an audit reduction capability that supports forensic investigations.
APSC-DV-001180 CAT II V-222492 · SRG-APP-000366

The application must provide a report generation capability that supports on-demand audit review and analysis.

Maps to AU-7 via CCI-001878

Check
Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering). Access the application with user rights sufficient to read and filter audit records. Navigate the application user interface and select the application functionality that provides access and interface to audit records and audit reporting. If the application uses a centralized logging solution that provides immediate, customizable audit review and analysis functions, the requirement is not applicable. Create an event report. Report data can be based on date ranges, times or events, or other criteria that could be used in an investigation. Use of data from previous checks for audit reduction is encouraged. Review the report and ensure the data in the report coincides with event filters used to create the report. If the application does not provide an immediate, ad-hoc audit review and analysis capability, this is a finding.

Fix
Design or configure the application to provide an immediate audit review capability or utilize a centralized utility designed for the purpose of on-demand log management and reporting.
APSC-DV-001190 CAT II V-222493 · SRG-APP-000367

The application must provide a report generation capability that supports on-demand reporting requirements.

Maps to AU-7 via CCI-001879

Check
Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering). Access the application with user rights sufficient to read and filter audit records. Navigate the application user interface and select the application functionality that provides access and interface to audit records and audit reduction (event filtering). If the application uses a centralized logging solution that provides immediate, customizable, ad-hoc report generation functions, the requirement is not applicable. Create an event report. Report data can be based on date ranges, times or events, or other criteria that could be used in an investigation. Use of data from previous checks for audit reduction is encouraged. Review the report and ensure the data in the report coincides with event filters used to create the report. If the application does not provide customizable, immediate, ad-hoc audit log reporting, this is a finding.

Fix
Design or configure the application to provide an on-demand report generation capability or utilize a centralized utility designed for the purpose of on-demand log management and reporting.
APSC-DV-001200 CAT II V-222494 · SRG-APP-000368

The application must provide a report generation capability that supports after-the-fact investigations of security incidents.

Maps to AU-7 via CCI-001880

Check
Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering). Access the application with user rights sufficient to read and filter audit records. Navigate the application user interface and select the application functionality that provides access and interface to audit records and audit reduction (event filtering). If the application uses a centralized logging solution that performs the report generation functions, the requirement is not applicable. Create an event report. Report data can be based on date ranges, times or events, or other criteria that could be used in an investigation. Use of data from previous checks for audit reduction is encouraged. Review the report and ensure the data in the report coincides with event filters used to create the report. If the application does not have a report generation capability that supports after the fact security investigations, this is a finding.

Fix
Design or configure the application to provide after-the-fact report generation capability or utilize a centralized utility designed for the purpose of log management and reporting.
APSC-DV-001210 CAT II V-222495 · SRG-APP-000369

The application must provide an audit reduction capability that does not alter original content or time ordering of audit records.

Maps to AU-7 via CCI-001881

Check
Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering). Access the application with user rights sufficient to read and filter audit records. Navigate the application user interface and select the application functionality that provides access and interface to audit records and audit reduction (event filtering). If the application uses a centralized logging solution that performs the audit reduction (event filtering) functions, the requirement is not applicable. Examine the log files; take note of dates and times of events such as logon events. Note: dates and times as well as the original content and any unique record identifiers. Record the identifying information as well as the dates and times and content of the audit records. Apply filters to reduce the amount of audit records displayed to just the logon events for the day. Review the records and ensure nothing in the records has changed. Once validated, clear the filter and review the records again to validate nothing changed within the audit record itself. If the application of event filters modifies the original log records, this is a finding.

Fix
Configure the application to not alter original log content or time ordering of audit records.
APSC-DV-001220 CAT II V-222496 · SRG-APP-000370

The application must provide a report generation capability that does not alter original content or time ordering of audit records.

Maps to AU-7 via CCI-001882

Check
Review the application documentation and interview the application administrator for details regarding audit reduction (log record event filtering). Access the application with user rights sufficient to read and filter audit records. Navigate the application user interface and select the application functionality that provides access and interface to audit records and audit reduction (event filtering). If the application does not provide a report generation capability, the requirement is not applicable. Examine the log files; take note of dates and times of events such as logon events. Note: dates and times as well as the original content and any unique record identifiers. Record the identifying information as well as the dates and times and content of the audit records. Apply filters to reduce the amount of audit records displayed to just the logon events for the day. Review the records and ensure nothing in the records has changed. Once validated, clear the filter and review the records again to validate nothing changed within the audit record itself. If the application of event filters modifies the original log records, this is a finding.

Fix
Configure and design the application to not modify source logs when filtering events.
APSC-DV-001250 CAT II V-222497 · SRG-APP-000116

The applications must use internal system clocks to generate time stamps for audit records.

Maps to AU-8 via CCI-000159

Check
Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components. Ensure the time written into the logs coincides with the OS timeclock. Access random audit records and review the most recent logs. Access the system OS hosting the application and use the related OS commands to determine the time of the system. Perform an action in the application that causes a log event to be written and review the log to ensure the system times and the application log times correlate; compensating for any time delays that may have occurred between running the OS time command and running the application action. If the application doesn't use the internal system clocks to generate time stamps for the audit event logs, this is a finding.

Fix
Configure the application to use the hosting systems internal clock for audit record generation.
APSC-DV-001260 CAT II V-222498 · SRG-APP-000374

The application must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

Maps to AU-8 via CCI-001890

Check
Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components. If the application utilizes the underlying OS system clock, and the system clock is mapped to UTC or GMT, this is not a finding. Identify where clock settings are configured within the application. Access the configuration settings and determine if the application is configured to set the time stamps for audit records according to UTC or GMT (e.g., East coast standard time is represented as GMT -5, east coast daylight savings time is represented as GMT-4). If the application is not configured to map to UTC or GMT, this is a finding.

Fix
Configure the application to use the underlying system clock that maps to relevant UTC or GMT timezone.
APSC-DV-001270 CAT II V-222499 · SRG-APP-000375

The application must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.

Maps to AU-8 via CCI-001889

Check
Review the system documentation and interview the application administrator to determine where application audit logs are written and how time stamps are recorded. If the application utilizes the underlying OS for time stamping and time synchronization when writing the audit logs, this requirement is not applicable. Access and review log files over a period of at least 10 minutes; compare time stamps written in the application log to the system clock to ensure time is synchronized to within 1 second of precision. If the application audit log time stamps differ from the OS time source by more than one second, this is a finding.

Fix
Configure the application to leverage the underlying operating system as the time source when recording time stamps or design the application to ensure granularity of 1 second as the minimum degree of precision.
APSC-DV-001280 CAT II V-222500 · SRG-APP-000118

The application must protect audit information from any type of unauthorized read access.

Maps to AU-9 via CCI-000162

Check
Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components. Identify the roles and users allowed to access audit information and the circumstances in which they are allowed to read or otherwise access the data. Identify the methods used to manage audit records and audit components. Typical methods are file system-based, via an application user interface via database access or a combination thereof. For file system access: Review file system permissions to ensure the audit logs and the application audit components such as executable files and libraries are protected by adequate file permission restrictions. Permissions must be configured to limit access to only those who have been identified and whose access has been approved. If file permissions are configured to allow unapproved access, this is a finding. For application-oriented and database access: Identify the application module that provides access to audit settings and audit data. Attempt to access audit configuration features and logs by using a regular non-privileged application or database user account. If a non-privileged user account is allowed to access the audit data or the audit configuration settings, this is a finding.

Fix
Configure the application to protect audit data from unauthorized access. Limit users to roles that are assigned the rights to view, edit or copy audit data, and establish permissions that control access to the audit logs and audit configuration settings.
APSC-DV-001290 CAT II V-222501 · SRG-APP-000119

The application must protect audit information from unauthorized modification.

Maps to AU-9 via CCI-000163

Check
Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components. Identify the roles and users allowed to modify audit information and the circumstances in which they are allowed to modify the data. Identify the methods used to manage audit records and audit components. Typical methods are file system-based, via an application user interface via database access or a combination thereof. For file system access: Review file system permissions to ensure the audit logs and the application audit components such as executable files and libraries are protected by adequate file permission restrictions. Permissions must be configured to limit write/modify access to only those who have been identified and whose access has been approved. If file permissions are configured to allow unapproved write/modify access, this is a finding. For application oriented and database access: Identify the application module that provides access to audit settings and audit data. Attempt to access audit configuration features and logs by using a regular non-privileged application or database user account. Once access has been established, attempt to modify an audit record and attempt to modify the audit settings. If a non-privileged user account is allowed to modify the audit data or the audit configuration settings, this is a finding.

Fix
Configure the application to protect audit data from unauthorized modification and changes. Limit users to roles that are assigned the rights to edit audit data and establish permissions that control access to the audit logs and audit configuration settings.
APSC-DV-001300 CAT II V-222502 · SRG-APP-000120

The application must protect audit information from unauthorized deletion.

Maps to AU-9 via CCI-000164

Check
Review the system documentation and interview the application administrator for details regarding application architecture and logging configuration. Identify the application components and the logs associated with the components. Identify the roles and users allowed to delete audit information and the circumstances in which they are allowed to delete the data. Identify the methods used to manage audit records and audit components. Typical methods are file system-based, via an application user interface via database access or a combination thereof. For file system access: Review file system permissions to ensure the audit logs and the application audit components such as executable files and libraries are protected by adequate file permission restrictions. Permissions must be configured to limit deletions to only those who have been identified and whose rights to delete audit data and audit configurations has been approved. If file permissions are configured to allow unapproved deletions of audit settings and data, this is a finding. For application oriented and database access: Identify the application module that provides access to audit settings and audit data. Attempt to access audit configuration features and logs by using a regular non-privileged application or database user account. Once access has been established, attempt to delete a test audit record and attempt to delete a test audit settings. If a non-privileged user account is allowed to delete the audit data or the audit configuration settings, this is a finding.

Fix
Configure the application to protect audit data from unauthorized deletion. Limit users to roles that are assigned the rights to delete audit data and establish permissions that control access to the audit logs and audit configuration settings.
APSC-DV-001310 CAT II V-222503 · SRG-APP-000121

The application must protect audit tools from unauthorized access.

Maps to AU-9 via CCI-001493

Check
Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and audit tools. Identify the application audit tools and their locations. If the application does not provide a distinct audit tool oriented functionality that is a separate tool with an ability to view and manipulate log data, this requirement is not applicable. Identify the methods used for implementing the audit tool functionality within the application. Typical methods are file system-based, e.g., a separate executable file that when invoked provides audit functionality, an application user interface to an audit module, or a combination thereof. For file system access: Review file system permissions to ensure the application audit components such as executable files and libraries are protected by adequate file permission restrictions. Permissions must be configured to limit access to only those who have been identified and whose access has been approved. If file permissions are configured to allow unapproved access, this is a finding. For circumstances where audit tools are accessed via application sub-modules or menus: Identify the application module that provides access to audit settings and audit data. Attempt to access audit configuration features and logs by using a regular non-privileged application or database user account. If a non-privileged user account is allowed to access the audit data or the audit configuration settings, this is a finding.

Fix
Configure the application to protect audit data from unauthorized access. Limit users to roles that are assigned the rights to view, edit or copy audit data, and establish file permissions that control access to the audit tools and audit tool capabilities and configuration settings.
APSC-DV-001320 CAT II V-222504 · SRG-APP-000122

The application must protect audit tools from unauthorized modification.

Maps to AU-9 via CCI-001494

Check
Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and provided audit tools. Identify the application audit tools and their locations. If the application does not provide a distinct audit tool oriented functionality that is a separate tool with an ability to view and manipulate log data, this requirement is not applicable. Identify the methods used for implementing an audit tool functionality that is separate from the application. Typical methods are file-oriented in nature, e.g., the application includes a separate executable file or library that when invoked allows users to view and manipulate logs. Identify the users with the rights to modify the audit tools. This capability will usually be reserved for admin staff. Review file system permissions to ensure the application audit components such as executable files and libraries are protected by adequate file permission restrictions. File permissions must be configured to limit access to only those users who have been identified and whose access has been approved. If file permissions are configured so as to allow unapproved modifications to the audit tools, this is a finding.

Fix
Configure the application to protect audit tools from unauthorized modifications. Limit users to roles that are assigned the rights to edit or update audit tools and establish file permissions that control access to the audit tools and audit tool capabilities and configuration settings.
APSC-DV-001330 CAT II V-222505 · SRG-APP-000123

The application must protect audit tools from unauthorized deletion.

Maps to AU-9 via CCI-001495

Check
Review the system documentation and interview the application administrator for details regarding application architecture, audit methods and provided audit tools. Identify the application audit tools and their locations. If the application does not provide a distinct audit tool oriented functionality that is a separate tool with an ability to view and manipulate log data, this requirement is not applicable. Identify the methods used for implementing an audit tool functionality that is separate from the application. Typical methods are file-oriented in nature, e.g., the application includes a separate executable file or library that when invoked allows users to view and manipulate logs. Identify the users with the rights to delete the audit tools. This capability is normally reserved for admin staff. Review file system permissions to ensure the application audit components such as executable files and libraries are protected by adequate file permission restrictions. File permissions must be configured to limit access to only those users who have been identified and whose access has been approved. If file permissions are configured to allow unapproved deletions of the audit tools, this is a finding.

Fix
Configure the application to protect audit tools from unauthorized deletions. Limit users to roles that are assigned the rights to edit or delete audit tools and establish file permissions that control access to the audit tools and audit tool capabilities and configuration settings.
APSC-DV-001340 CAT II V-222506 · SRG-APP-000125

The application must back up audit records at least every seven days onto a different system or system component than the system or component being audited.

Maps to AU-9(2) via CCI-001348

Check
Review the application documentation and interview the application administrator. Identify log functionality and locations of log files. If the application does not include a built-in backup capability for backing up its own audit records, this requirement is not applicable. Access the management interface for configuring application audit logs and review the backup settings. If the application backup settings are not configured to backup application audit records every 7 days, this is a finding.

Fix
Configure application backup settings to backup application audit logs every 7 days.
APSC-DV-001350 CAT II V-222507 · SRG-APP-000126

The application must use cryptographic mechanisms to protect the integrity of audit information.

Maps to AU-9(3) via CCI-001350

Check
Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and provided audit tools. Identify the location of the application audit information. If the application is configured to utilize a centralized audit log solution that uses cryptographic methods that meet this requirement such as creating cryptographic hash values or message digests that can be used to validate integrity of audit files, the requirement is not applicable. Ask application administrator to demonstrate the cryptographic mechanisms used to protect the integrity of audit data. Verify when application logs are stored on the file system, a process that includes the creation of an integrity check of the audit file being stored is utilized. This integrity check can be the creation of a checksum, message digest or other one-way cryptographic hash of the audit file that is created. If an integrity check is not created to protect the integrity of the audit information, this is a finding.

Fix
Configure the application to create an integrity check consisting of a cryptographic hash or one-way digest that can be used to establish the integrity when storing log files.
APSC-DV-001360 CAT II V-222508 · SRG-APP-000290

Application audit tools must be cryptographically hashed.

Maps to AU-9(3) via CCI-001496

Check
Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and provided audit tools. Identify the location of the application audit tools. Separate audit tools will be file-oriented in nature, e.g., the application includes a separate executable file or library that when invoked allows users to view and manipulate logs. If the application does not provide a separate tool in the form of a file which provides an ability to view and manipulate application log data, query data, or generate reports, this requirement is not applicable. If the system hosting the application has a separate file monitoring utility installed that is configured to identify changes to audit tools and alarm on changes to audit tools, this is not applicable. Ask application administrator to demonstrate the cryptographic hashing mechanisms used to create the one way hashes that can be used to validate the integrity of audit tools. For example, "shasum /path/to/file > checksum.filename". Ask the application administrator to provide the list of checksum values and the associated file names of the audit tools. If a cryptographic checksum or hash value of the audit tool file is not created for future reference, this is a finding.

Fix
Cryptographically hash the audit tool files used by the application. Store and protect the generated hash values for future reference.
APSC-DV-001370 CAT II V-222509 · SRG-APP-000290

The integrity of the audit tools must be validated by checking the files for changes in the cryptographic hash value.

Maps to AU-9(3) via CCI-001496

Check
Review the system documentation and interview the application administrator for details regarding application architecture, audit methods, and provided audit tools. Identify the location of the application audit tools. Separate audit tools will be file-oriented in nature, e.g., the application includes a separate executable file or library that when invoked allows users to view and manipulate logs. If the application does not provide a separate tool in the form of a file which provides an ability to view and manipulate application log data, query data or generate reports, this requirement is not applicable. If the system hosting the application has a separate file monitoring utility installed that is configured to identify changes to audit tools and alarm on changes to audit tools, this is not applicable. Ask the application administrator to provide their process for periodically checking the list of checksum values against the associated file names of the audit tools to ensure none of the audit tools have been tampered with. If a cryptographic checksum or hash value of the audit tool file is not periodically checked to ensure the integrity of audit tools, this is a finding.

Fix
Establish a process to periodically check the audit tool cryptographic hashes to ensure the audit tools have not been tampered with.
APSC-DV-001390 CAT II V-222510 · SRG-APP-000378

The application must prohibit user installation of software without explicit privileged status.

Maps to CM-11(2) via CCI-003980, CCI-001812

Check
Review the application documentation and interview the application administrator to determine the capabilities of the application as it relates to software installation or product function extension. Identify any software configuration change capabilities which are allowed by design and incorporated into the user interface. An example is utilizing a known software repository of tested and approved extensions, plugins, or modules which can be used by application users to extend application features or functions. If the application does not provide the ability to install software components, modules, plugins, or extensions, the requirement is Not Applicable. Access the application user interface as a regular user, navigate to the application screen that provides the software installation function and attempt to install software components, modules, extensions, or plugins. If the application utilizes an approved repository of approved software that has been tested and approved for all application users to install, this is not a finding. If the application allows regular users to install untested or unapproved software components, extensions, modules, or plugins without explicit authorization, this is a finding.

Fix
Configure the application to prohibit user installation of software without explicit permission.
APSC-DV-001410 CAT II V-222511 · SRG-APP-000380

The application must enforce access restrictions associated with changes to application configuration.

Maps to CM-5(1) via CCI-001813

Check
Review the application documentation and configuration settings. Access the application configuration settings interface as a regular non-privileged user. Attempt to make configuration changes to the application. If configuration changes can be made by regular non-privileged users, this is a finding. Review the locations of all configuration files used by the application. Examine the file permission settings and determine who has access to the configuration files. If access permissions to configuration files are not restricted to application administrators, this is a finding.

Fix
Configure the application to limit access to configuration settings to only authorized users.
APSC-DV-001420 CAT II V-222512 · SRG-APP-000381

The application must audit who makes configuration changes to the application.

Maps to CM-5(1) via CCI-003938, CCI-001814

Check
Review the application documentation and configuration settings. Access the application configuration settings interface as a privileged user. Make configuration changes to the application. Review the application audit logs and ensure a log entry is made identifying the privileged user account that was used to make the changes. If application configuration is maintained by using a text editor to modify a configuration file, modify the configuration file with a text editor. Review the system logs and ensure a log entry is made for the file modification that identifies the user that was used to make the changes. If the user account is not logged, or is a group account such as "root", this is a finding. If the user account used to make the changes is not logged in the audit records, this is a finding.

Fix
Configure the application to create log entries that can be used to identify the user accounts that make application configuration changes.
APSC-DV-001430 CAT II V-222513 · SRG-APP-000131

The application must have the capability to prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.

Maps to CM-5(3), CM-14 via CCI-003992, CCI-001749

Check
Review the application documentation and interview the application administrator to determine the process and commands used for patching the application. Access application configuration settings. Review commands and procedures used to patch the application and ensure a capability exists to prevent unsigned patches from being applied. If the application is not capable of preventing installation of patches and packages that are not signed, or if the vendor does not provide a cryptographic hash value that can be manually checked prior to installation, this is a finding.

Fix
Design and configure the application to have the capability to prevent unsigned patches and packages from being installed. Provide a cryptographic hash value that can be verified by a system administrator prior to installation.
APSC-DV-001440 CAT II V-222514 · SRG-APP-000133

The applications must limit privileges to change the software resident within software libraries.

Maps to CM-5(6) via CCI-001499

Check
Review the application documentation and interview the application administrator to identify the application architecture. Identify application folders where application libraries are stored. Review permissions of application folders and library files contained with the folders to ensure file permissions restrict access to authorized users or processes. Access application configuration settings. Examine settings for capability to update software libraries or extend application functionality via the application. Review user roles and access rights within the application to determine if access to this capability is restricted to authorized users. If file restrictions do not limit write access to library files and if the application does not restrict access to library update functionality, this is a finding.

Fix
Configure the application OS file permissions to restrict access to software libraries and configure the application to restrict user access regarding software library update functionality to only authorized users or processes.
APSC-DV-001460 CAT II V-222515 · SRG-APP-000516

An application vulnerability assessment must be conducted.

Maps to CM-6 via CCI-000366

Check
Review the application documentation to understand application architecture. Interview the application administrator, obtain and review their application vulnerability scanning process. Request the latest scan results including scan configuration settings. Review scan configurations and ensure coverage of all application architecture has been tested. The proper scanning tool or combination of tools must be utilized in order to ensure the full range of application features and functionality is tested. For example, if the application includes a web interface and a SQL database, then ensure test results for web and SQL vulnerabilities are provided. Although web and SQL applications are included as examples and are the prevalent types of applications, this requirement is not intended to be limited to just the aforementioned application architectures. Ensure test results are provided from all testing tools employed during vulnerability testing. If high risk security vulnerabilities are identified in the scan results, request subsequent test results that indicate the issues have been fixed or mitigated. If the high risk issues identified in the report have not been fixed or mitigated to a level accepted by the ISSO and the ISSM, or if the application administrator cannot produce vulnerability security testing results that cover the range of application functionality, this is a finding.

Fix
Configure the application vulnerability scanners to test all components of the application, conduct vulnerability scans on a regular basis and remediate identified issues. Retain scan results for compliance verification.
APSC-DV-001480 CAT II V-222516 · SRG-APP-000384

The application must prevent program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage.

Maps to CM-7(2) via CCI-001764

Check
Review the application documentation and interview the application administrator to determine if policies, rules, or restrictions exist regarding application usage or terms which authorize the conditions of application use. If the policy, terms, or conditions state there are no usage restrictions, this requirement is not applicable. Interview the application administrator, review policy, terms, and conditions documents to determine what the terms and conditions of application usage are. Have the application administrator demonstrate how the program execution is restricted in accordance with the policy terms and conditions. Typical methods include but are not limited to the use of Windows Group Policy, AppLocker, Software Restriction Policies, Java Security Manager, and Role-Based Access Control (RBAC). If application requirements or policy documents specify application execution restriction requirements and the execution of the application or its subcomponents are not restricted in accordance with requirements or policy, this is a finding.

Fix
Restrict application execution in accordance with the policy, terms, and conditions specified.
APSC-DV-001490 CAT II V-222517 · SRG-APP-000386

The application must employ a deny-all, permit-by-exception (whitelist) policy to allow the execution of authorized software programs.

Maps to CM-7(5) via CCI-001774

Check
If the application is not a configuration management or similar type of application designed to manage system processes and configurations, this requirement is not applicable. Review the application documentation and interview the application administrator to identify if application whitelisting specifying which applications or application subcomponents are allowed to execute is in use. Check for the existence of policy settings or policy files that can be configured to restrict application execution. Have the application administrator demonstrate how the program execution is restricted. Look for a deny-all, permit-by-exception policy of restriction. Some methods for restricting execution include but are not limited to the use of custom capabilities built into the application or leveraging of Windows Group Policy, AppLocker, Software Restriction Policies, Java Security Manager or Role-Based Access Controls (RBAC). If application whitelisting is not utilized or does not follow a deny-all, permit-by-exception (whitelist) policy, this is a finding.

Fix
Configure the application to utilize a deny-all, permit-by-exception policy when allowing the execution of authorized software.
APSC-DV-001500 CAT II V-222518 · SRG-APP-000141

The application must be configured to disable non-essential capabilities.

Maps to CM-7 via CCI-000381

Check
Review the application guidance, application requirements documentation, and interview the application administrator. Identify the application's operational requirements and what services the application is intended to provide users. Review the overall application features and functionality via the user interface. Review and identify installed application software modules via configuration settings. Using the relevant OS commands, identify services running on the system and have the application administrator identify the services related to the application. If the application is operating with extraneous capabilities that have not been defined as required in order to meet mission objectives, this is a finding.

Fix
Disable application extraneous application functionality that is not required in order to fulfill the application's mission.
APSC-DV-001510 CAT II V-222519 · SRG-APP-000142

The application must be configured to use only functions, ports, and protocols permitted to it in the PPSM CAL.

Maps to CM-7 via CCI-000382

Check
Review the application documentation and configuration. Interview the application administrator. Identify the network ports and protocols that are utilized by the application. Using a combination of relevant OS commands and application configuration utilities, identify the TCP/IP port numbers the application is configured to utilize and is utilizing. Review the PPSM Category Assurance List (CAL) at: https://cyber.mil/ppsm/cal/ Verify the ports used by the application are approved by the PPSM CAL. If the ports are not approved by the PPSM CAL, this is a finding.

Fix
Configure the application to utilize application ports approved by the PPSM CAL.
APSC-DV-001520 CAT II V-222520 · SRG-APP-000389

The application must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.

Maps to IA-11, SC-11 via CCI-004895, CCI-002038

Check
Review the application guidance and interview the application administrator. Identify the application user roles. Identify the methods and manner in which an application user is allowed to escalate their privileges or change their role. Create or utilize an account that has two roles within the application, both should be nonadministrator. Example: User role and Report Creator role. Authenticate to the application as the user in the User role. Access the application functionality that allows the user to change their role and change from the User role to the Report Creator role. If the user is not prompted to reauthenticate before the user’s role is changed, this is a finding. Log out of the application and log back in as the User role. Access the application functionality that allows the user to escalate their privileges to an administrative user. Attempt to escalate the privileges of the user. If the user is not prompted to reauthenticate before the user is allowed to proceed with escalated privileges, this is a finding.

Fix
Configure the application to require reauthentication before user privilege is escalated and user roles are changed.
APSC-DV-001530 CAT II V-222521 · SRG-APP-000390

The application must require devices to reauthenticate when organization-defined circumstances or situations requiring reauthentication.

Maps to IA-11 via CCI-002038

Check
Review the application guidance and interview the application administrator. Identify the methods and manner in which application devices such as an XML gateway, SOA application gateway, or application firewall is allowed to access the application. Most devices themselves will not change role or authenticators once they are established but will need to periodically reauthenticate. Review the configuration setting in the application where the time period is set to force the device to reauthenticate. Review local policy requirements to determine if reauthentication intervals are specified. If the device is not forced to reauthenticate periodically, this is a finding.

Fix
Configure the application to require reauthentication periodically.
APSC-DV-001550 CAT II V-222523 · SRG-APP-000149

The application must use multifactor (Alt. Token) authentication for network access to privileged accounts.

Maps to IA-2(1) via CCI-000765

Check
Review the application documentation and interview the application administrator to identify application access methods. Ask the application administrator to present both their primary CAC and their Alt. Token. Ask the application administrator to log on to the application using application relevant network based access methods. Attempt to use both CAC and Alt. Tokens to authenticate to the application. Validate the application requests the user to input their CAC PIN and that they cannot perform administrative functions. Have user logoff and reauthenticate with their Alt. Token and that they can perform administrative functions. If the application allows administrative access to the application without requiring an Alt. Token, this is a finding.

Fix
Configure the application to use an Alt. Token when providing network access to privileged application accounts.
APSC-DV-001560 CAT II V-222524 · SRG-APP-000391

The application must accept Personal Identity Verification (PIV) credentials.

Maps to IA-2(12) via CCI-001953

Check
Review the application documentation and interview the application administrator to identify application access methods. If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable. Ask the application administrator to log on to the application. Have the application admin use their non-privileged credentials. Validate the application prompts the user to provide a certificate from the CAC. If the application allows access without requiring a CAC, this is a finding.

Fix
Configure the application to require CAC authentication.
APSC-DV-001570 CAT II V-222525 · SRG-APP-000392

The application must electronically verify Personal Identity Verification (PIV) credentials.

Maps to IA-2(12) via CCI-001954

Check
Review the application documentation and interview the application administrator to identify application access methods. If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable. Ask the application administrator to log on to the application. Validate the application prompts the user to provide a certificate from the CAC. Validate the application requests the user to input their CAC PIN. If the application allows access without requiring a CAC, this is a finding.

Fix
Configure the application to require CAC authentication.
APSC-DV-001580 CAT II V-222526 · SRG-APP-000150

The application must use multifactor (e.g., CAC, Alt. Token) authentication for network access to non-privileged accounts.

Maps to IA-2(2) via CCI-000766

Check
Review the application documentation and interview the application administrator to identify application access methods. If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable. Ask the application administrator to log on to the application. Have the application admin use their non-privileged credentials. Validate the application prompts the user to provide a certificate from the CAC. Validate the application requests the user to input their CAC PIN. If the application allows access without requiring a CAC or Alt. Token, this is a finding.

Fix
Configure the application to require CAC or Alt. Token authentication for non-privileged network access to non-privileged accounts.
APSC-DV-001590 CAT II V-222527 · SRG-APP-000151

The application must use multifactor (Alt. Token) authentication for local access to privileged accounts.

Maps to IA-2(1), IA-2(3) via CCI-000765, CCI-000767

Check
Review the application documentation and interview the application administrator to identify application access methods. Ask the application administrator to present both their primary CAC and their Alt. Token. Ask the application administrator to log on to the application using the local application console. Attempt to use both the CAC and Alt. Tokens to authenticate to the application. Validate the application requests the user to input their CAC PIN and that they cannot perform administrative functions. Have user log off and reauthenticate with their Alt. Token and verify they can perform administrative functions. If the application allows administrative access to the application without requiring an Alt. Token, this is a finding.

Fix
Configure the application to only use Alt. Tokens when locally accessing privileged application accounts.
APSC-DV-001600 CAT II V-222528 · SRG-APP-000152

The application must use multifactor (e.g., CAC, Alt. Token) authentication for local access to nonprivileged accounts.

Maps to IA-2(2), IA-2(4) via CCI-000766, CCI-000768

Check
Review the application documentation and interview the application administrator to identify application access methods. If the application is not PKI-enabled due to the hosted data being publicly releasable, this check is Not Applicable. Ask the application administrator to log on to the application. Have the application admin use their nonprivileged credentials. Validate the application prompts the user to provide a certificate from the CAC. Validate the application requests the user to input their CAC PIN. If the application allows access without requiring a CAC or Alt. Token, this is a finding.

Fix
Configure the application to require CAC or Alt. Token authentication for nonprivileged network access.
APSC-DV-001610 CAT II V-222529 · SRG-APP-000153

The application must ensure users are authenticated with an individual authenticator prior to using a group authenticator.

Maps to IA-2(5) via CCI-004045, CCI-000770

Check
Review the application documentation, examine user accounts and group membership, and interview the application administrator to identify group or shared accounts. Document the group or shared account information. If the application does not use group or shared accounts, this requirement is Not Applicable. Create a test account or use an existing group member account. Ensure the test account is not authenticated to the application and attempt to access the application with the group account credentials. If the application allows access without first requiring the group member to authenticate with their individual credentials, this is a finding.

Fix
Design and configure the application to individually authenticate group account members prior to allowing access.
APSC-DV-001620 CAT II V-222530 · SRG-APP-000156

The application must implement replay-resistant authentication mechanisms for network access to privileged accounts.

Maps to IA-2(8) via CCI-001941

Check
Review application documentation and interview application administrator to identify what authentication mechanisms are used when accessing the application. If the application is hosting publicly releasable information that does not require authentication, or if the application users are not eligible for a DoW CAC as per DoD 8520, this requirement is not applicable. Review to ensure the application is utilizing TLSV1.2 or greater to protect communication and privileged user authentication traffic. Verify the application utilizes a strong authentication mechanism such as Kerberos, IPSEC, or Secure Shell (SSH). - Cryptographically sign web services packets. - Time stamps and cryptographic hashes are used with web services packets. - Use WS_Security for web services. Request the most recent vulnerability scan results and configuration settings. Verify the configuration is set to test for known replay vulnerabilities. Request code review results (if available) and review for issues that have been identified as potential replay attack vulnerabilities. Verify identified issues have been remediated. If the application is not implementing replay-resistant authentication methods applicable to the application architecture, this is a finding.

Fix
Design and configure the application to utilize replay-resistant mechanisms when authenticating privileged accounts.
APSC-DV-001630 CAT II V-222531 · SRG-APP-000157

The application must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.

Maps to IA-2(8), IA-2(9) via CCI-001941, CCI-001942

Check
Review the application documentation and interview the application administrator to identify what authentication mechanisms are used when accessing the application. If the application is hosting publicly releasable information that does not require authentication, or if the application users are not eligible for a DoW CAC as per DOD 8520, this requirement is Not Applicable. Review to ensure the application is utilizing TLSV1.2 or greater to protect communication and nonprivileged user authentication traffic. Verify the application utilizes a strong authentication mechanism such as Kerberos, IPSEC, or Secure Shell (SSH). - Cryptographically sign web services packets. - Time stamps and cryptographic hashes are used with web services packets. - Use WS_Security for web services. Request the most recent vulnerability scan results and configuration settings. Verify the configuration is set to test for known replay vulnerabilities. Request code review results (if available) and review for issues that have been identified as potential replay attack vulnerabilities. Verify identified issues have been remediated. If the application is not implementing replay-resistant authentication methods applicable to the application architecture, this is a finding.

Fix
Design and configure the application to utilize replay-resistant mechanisms when authenticating nonprivileged accounts.
APSC-DV-001640 CAT II V-222532 · SRG-APP-000158

The application must utilize mutual authentication when endpoint device non-repudiation protections are required by DoW policy or by the data owner.

Maps to IA-3 via CCI-000778

Check
Review the application documentation and interview the application administrator. Determine if mutual authentication is mandated by the data owner or by mission data protection objectives and data type. Review application architecture and design documents. Identify endpoint devices that interact with the application. These can be SOA gateways, VOIP phones, or other devices that are used to connect to and exchange data with the application. If the design documentation specifies, this could potentially also include remote client workstations. In order for two way SSL/mutual authentication to work properly, the server must be configured to request client certificates. Access the applications management console. Navigate to the SSL management utility or web page that is used to configure two way mutual authentication. Verify endpoints are configured for client authentication (mutual authentication). Some application architectures such as Java configure their settings in text/xml formatted files; in that case, have the application administrator identify the configuration files used by the application. E.g., web.xml stored in WEB-INF/ sub directory of the application root folder. Open the web.xml file using a text editor. Verify the application deployment descriptor for the application and the resource requiring protection under the "login-config" element is set to CLIENT-CERT. If SSL mutual authentication is required and is not being utilized, this is a finding.

Fix
Configure the application to utilize mutual authentication when specified by data protection requirements.
APSC-DV-001650 CAT II V-222533 · SRG-APP-000394

The application must authenticate all network connected endpoint devices before establishing any connection.

Maps to IA-3 via CCI-001958

Check
Review the application documentation, implementation documentation and interview the application administrator. Identify if the application utilizes Web Services/Service-Oriented Architecture (SOA). Using the web services framework that has been implemented, have the application administrator identify the remote devices allowed to communicate to the service provider. If the application is designed to provide end-user, interactive application access only and does not use web services or allow connections from remote devices, this requirement is not applicable. Identify the authentication mechanism used to authenticate the remote consumers/devices. Commonly available authentication methods are Client Certificate Authentication and Basic Authentication. The Basic Authentication method provides insufficient protection for authentication sessions and is not allowed. If no authentication mechanism is used to authenticate remote service consumers/devices, or if Basic Authentication is used to authentication remote service consumers/devices, this is a finding.

Fix
Configure the application to authenticate all network connected endpoint devices/service consumers before establishing connections.
APSC-DV-001660 CAT II V-222534 · SRG-APP-000395

Service-Oriented Applications handling non-releasable data must authenticate endpoint devices via mutual SSL/TLS.

Maps to IA-3(1) via CCI-001967

Check
Review application documentation and interview application administrator. Identify application data elements and determine if the application is handling/processing non-releasable data. Review the application architecture and design documents. Identify endpoint devices that interact with the application. These can be SOA gateways, VOIP phones, or other devices that are used to connect to and exchange data with the application. If the design documentation specifies it, this could also include remote client workstations. However, this requirement is usually reserved for system-oriented endpoints rather than client workstations. In order for two way SSL/TLS mutual authentication to work properly, the server must be configured to request client certificates. Access the applications management console and navigate to the SSL/TLS management utility or web page that is used to configure two-way mutual authentication. Verify endpoints are configured for client authentication (mutual authentication). Some application architectures configure their settings in text/xml formatted files; in that case, have the application administrator identify the configuration files used by the application (e.g., web.xml stored in WEB-INF/ sub directory of the application root folder). Open the web.xml file using a text editor and verify the application deployment descriptor for the application and the resource requiring protection under the "login-config" element is set to CLIENT-CERT. If SSL/TLS mutual authentication is required due to the application processing non-releasable data and SSL/TLS mutual authentication not being utilized, this is a finding.

Fix
Configure the application to utilize mutual authentication when the application is processing non-releasable data.
APSC-DV-001670 CAT II V-222535 · SRG-APP-000163

The application must disable device identifiers after 35 days of inactivity unless a cryptographic certificate is used for authentication.

Maps to AC-2(3), IA-4 via CCI-003627, CCI-000795

Check
Review the application documentation and interview the application administrator. If the application is not designed to authenticate devices (such as mobile phones, gateways or other smart devices), or uses DoW PKI certificates to authenticate these devices, this requirement is Not Applicable. Access the user management interface for the application. Identify application device IDs. If the application utilizes approved certificates or a centralized authentication store (Active Directory or LDAP) as the authoritative source for application authentication, and the authentication store is configured to meet the requirement to disable device IDs after 35 days of inactivity, this is not a finding. Accounts such as guest and anonymous as well as roles and groups or other identities used to operate the application or to provide limited guest access are not applicable. Access the application user management interface and review the account settings that pertain to devices. Verify the application is configured to disable device accounts that have not been active or logged into the application for the past 35 days. If the application does not disable accounts used to authenticate devices after 35 days of inactivity, this is a finding.

Fix
Configure the application to disable device accounts after 35 days of inactivity or to utilize DoW PKI certificates that provide an expiration date.
APSC-DV-001690 CAT II V-222537 · SRG-APP-000166

The application must enforce password complexity by requiring that at least one uppercase character be used.

Maps to IA-5(1) via CCI-004066, CCI-000192

Check
Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities. When prompted to provide the password, attempt to create a password that does not have one uppercase character. If a password without at least one upper-case character can be created, this is a finding.

Fix
Configure the application to require at least one uppercase character in the password.
APSC-DV-001700 CAT II V-222538 · SRG-APP-000167

The application must enforce password complexity by requiring that at least one lowercase character be used.

Maps to IA-5(1) via CCI-004066, CCI-000193

Check
Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities. When prompted to provide the password, attempt to create a password that does not have one lowercase character. If a password without at least one lower-case character can be created, this is a finding.

Fix
Configure the application to require at least one lowercase character in the password.
APSC-DV-001710 CAT II V-222539 · SRG-APP-000168

The application must enforce password complexity by requiring that at least one numeric character be used.

Maps to IA-5(1) via CCI-004066, CCI-000194

Check
Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities. When prompted to provide the password, attempt to create a password that does not have one numeric character. If a password without at least one numeric character can be created, this is a finding.

Fix
Configure the application to require at least one numeric character in the password.
APSC-DV-001720 CAT II V-222540 · SRG-APP-000169

The application must enforce password complexity by requiring that at least one special character be used.

Maps to IA-5(1) via CCI-004066, CCI-001619

Check
Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities. When prompted to provide the password, attempt to create a password that does not have one special character. If a password without at least one special character can be created, this is a finding.

Fix
Configure the application to require at least one special character in the password.
APSC-DV-001730 CAT II V-222541 · SRG-APP-000170

The application must require the change of at least eight of the total number of characters when passwords are changed.

Maps to IA-5(1) via CCI-004066, CCI-000195

Check
Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities. When prompted to provide the password, attempt to change less than 8 characters of the total number of characters in the password. If less than 8 characters of the password are changed, this is a finding.

Fix
Configure the application to require the change of at least eight characters in the password when passwords are changed.
APSC-DV-001760 CAT II V-222544 · SRG-APP-000173

The application must enforce 24 hours/1 day as the minimum password lifetime.

Maps to IA-5(1) via CCI-004066, CCI-000198

Check
Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and create a test user account or logon to the system with a test account and access the functionality that provides password change capabilities. Attempt to change the password more than once. If a password can be changed more than once within 24 hours, the minimum lifetime setting is not set and this is a finding.

Fix
Configure the application to have a minimum password lifetime of 24 hours.
APSC-DV-001770 CAT II V-222545 · SRG-APP-000174

The application must enforce a 180-day maximum password lifetime restriction.

Maps to IA-5(1) via CCI-004066, CCI-000199

Check
Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and view the user password settings page. Review user password settings and validate the application is configured to expire and force a password change after 180 days. If user passwords are not configured to expire after 180 days, or if the application does not have the ability to control this setting, this is a finding.

Fix
Configure the application to have a maximum password lifetime of 180 days.
APSC-DV-001780 CAT II V-222546 · SRG-APP-000165

The application must prohibit password reuse for a minimum of five generations.

Maps to IA-5(1) via CCI-004061

Check
Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and view the user password settings page. Review user password settings and validate the application is configured to prohibit password reuse for a minimum of five password generations. If the application does not prevent users from reusing their previous five passwords, or if the application does not have the ability to control this setting, this is a finding.

Fix
Configure the application to prohibit password reuse for up to five passwords.
APSC-DV-001790 CAT II V-222547 · SRG-APP-000397

The application must allow the use of a temporary password for system logons with an immediate change to a permanent password.

Maps to CM-6 via CCI-000366

Check
Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication. If the application does not use passwords, this requirement is Not Applicable. Access the application management interface and view the user password settings page. Review user password settings and validate the application is configured to specify when a password is temporary and force a password change when the administrator either creates a new user account or changes a user’s password. If the application can not specify a password as temporary and force the user to change the temporary password upon successful authentication, this is a finding.

Fix
Configure the application to specify when a password is temporary and change the temporary password on the first use.
APSC-DV-001795 CAT II V-222548 · SRG-APP-000516

The application password must not be changeable by users other than the administrator or the user with which the password is associated.

Maps to IA-5 via CCI-000184

Check
Review the application documentation and interview application administrator. Determine if the application utilizes passwords. If the application does not utilize passwords, the requirement is NA. Identify the processes, commands or web pages the application uses to allow application users to change their own passwords. This includes but is not limited to password resets. If the application does not allow users to change or reset their passwords, the requirement is NA. Obtain two application test accounts, referred to here as User A and User B. Access the application as User A. Utilize the application password reset or change processes and determine if User A is allowed to specify or otherwise force a password change for User B. If User A is allowed to change or force a reset of User B's password, this is a finding.

Fix
Use a CAC to authenticate users instead of using passwords. If application users are prohibited or prevented from obtaining a CAC due to DoW policy requirements and passwords are the only viable option, design the application to utilize a secure password change or password reset process. Utilize out of band (OOB) communication techniques to communicate password change requests to users. Ensure verification processes exist that allow users to validate the change request prior to implementing the password change. Ensure users are only allowed to change their own passwords.
APSC-DV-001800 CAT II V-222549 · SRG-APP-000400

The application must terminate existing user sessions upon account deletion.

Maps to IA-5(13) via CCI-002007

Check
Review the application documentation and interview the application administrator. Identify the user management functions of the application and create a test user account. Access the application and perform application functions as the test user. Access the user management functions and delete the test account while the test user sessions are still active. Verify the test user application sessions are terminated by attempting to perform additional application functions. If the test user retains access after the test account has been deleted, this is a finding.

Fix
Configure the application to terminate existing sessions of users whose accounts are deleted.
APSC-DV-001830 CAT II V-222552 · SRG-APP-000177

The application must map the authenticated identity to the individual user or group account for PKI-based authentication.

Maps to IA-5(2) via CCI-000187

Check
Review the application documentation and interview the application administrator to identify how the application maps individual user certificates or group accounts to individual users. Access the application as a regular user while reviewing the application logs to determine if the application records the individual name of the user or if the application only includes certificate information. If the application only logs certificate information which contains no discernable user data, ask the system admin what their process is for mapping the certificate information to the user. If the application does not map the certificate data to an individual user or group, or if the administrator has no automated process established for determining the identity of the user, this is a finding.

Fix
Configure the application to map certificate information to individual users or group accounts or create a process for automatically determining the individual user or group based on certificate information provided in the logs.
APSC-DV-001840 CAT II V-222553 · SRG-APP-000401

The application, for PKI-based authentication, must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.

Maps to IA-5(2) via CCI-004068, CCI-001991

Check
Review the application documentation and interview the system administrator to identify how the application checks certificate revocation. If the application resides on the SIPRnet and does not have access to the root CAs, this requirement is Not Applicable. Different application frameworks may handle this requirement for the developer or the developer may have chosen to implement their own implementation for managing and implementing the CRL. Have the administrator demonstrate the process used for obtaining and importing the CRL. CAs may publish the CRL in an LDAP directory or it may be posted to an HTTP server. Verify the application is configured to import the CRL on a regular basis. Have the administrator demonstrate the configuration setting that enables CRL checking in the event the OCSP server is not available. If the application is not configured to implement a CRL, this is a finding.

Fix
Implement a CRL import process and configure the application to check the CRL if OCSP is not available.
APSC-DV-001870 CAT II V-222556 · SRG-APP-000180

The application must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

Maps to IA-8 via CCI-000804

Check
Review the application documentation and interview the application administrator. If the application does not host non-organizational users, this requirement is not applicable. Review the application and verify authentication is enabled and required in order for users to access the application. Review the application user base and determine if all user accounts are documented and assigned to a unique individual. Review risk acceptance documentation to determine if there are specific accesses identified that do not require authentication. If the application does not identify and authenticate non-organizational users and there is no risk acceptance documentation approving the exception, this is a finding.

Fix
Configure the application to identify and authenticate all non-organizational users.
APSC-DV-001880 CAT II V-222557 · SRG-APP-000402

The application must accept Personal Identity Verification (PIV) credentials from other federal agencies.

Maps to IA-8(1) via CCI-002009

Check
Review the application documentation and interview the application administrator to identify application access methods. If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable. If the application is only deployed to SIPRNet, this requirement is not applicable. If the application is not intended to be available to Federal government (non-DoW) partners this requirement is not applicable. Ask the application administrator to demonstrate how the application is configured to allow the use of PIV credentials from other agencies. If the application is required to provide authenticated access to Federal agencies and it does not accept a PIV, this is a finding.

Fix
Configure the application to accept PIV credentials when utilizing authentication provided by Federal (Non-DoW) agencies.
APSC-DV-001890 CAT II V-222558 · SRG-APP-000403

The application must electronically verify Personal Identity Verification (PIV) credentials from other federal agencies.

Maps to IA-8(1) via CCI-002010

Check
Review the application documentation and interview the application administrator to identify application access methods. If the application is not PK-enabled due to the hosted data being publicly releasable, this check is not applicable. If the application is only deployed to SIPRNet, this requirement is not applicable. If the application is not intended to be available to Federal government (non-DoW) partners this requirement is not applicable. Ask the application administrator to demonstrate how the application is configured to verify the PIV credentials from other agencies when they are presented as an authentication token. If the application is required to provide authenticated access to Federal agencies and it does not verify the PIV, this is a finding.

Fix
Configure the application to verify the PIV credentials presented when utilizing authentication provided by Federal (Non-DoW) agencies.
APSC-DV-001900 CAT II V-222559 · SRG-APP-000404

The application must accept Federal Identity, Credential, and Access Management (FICAM)-approved third-party credentials.

Maps to IA-8(2) via CCI-004083, CCI-002011

Check
Review the application documentation and interview the application administrator to identify application access methods. If the application is not PKI-enabled due to the hosted data being publicly releasable, this check is Not Applicable. If the application is only deployed to SIPRNet, this requirement is Not Applicable. If the application is not intended to be available to federal government partners this requirement is Not Applicable. Ask the application administrator to demonstrate how the application is configured to allow the use of third-party credentials, verify the third-party credentials are FICAM approved. If the application does not accept FICAM-approved credentials when accepting third-party credentials, this is a finding.

Fix
Configure applications intended to be accessible to nonfederal government agencies to use FICAM-approved third-party credentials.
APSC-DV-001910 CAT II V-222560 · SRG-APP-000405

The application must conform to Federal Identity, Credential, and Access Management (FICAM)-issued profiles.

Maps to IA-8(4) via CCI-004085, CCI-002014

Check
Review the application documentation and interview the application administrator to identify application access methods. If the application is not PKI-enabled due to the hosted data being publicly releasable, this check is Not Applicable. If the application is only deployed to SIPRnet, this requirement is Not Applicable. If the application is not intended to be available to federal government partners this requirement is Not Applicable. This requirement applies to DoW service providers who are relying parties of external (federal government) identity providers. Ask the application administrator to demonstrate how the application conforms to FICAM issued profiles such as SAML or OPENID. If the application is designed to be a service provider utilizing an external identify provider and does not conform to FICAM-issued profiles, this is a finding.

Fix
Configure the application to conform to FICAM-issued technical profiles when providing services that rely on external (federal government) identity providers.
APSC-DV-001930 CAT II V-222561 · SRG-APP-000409

Applications used for non-local maintenance sessions must audit non-local maintenance and diagnostic sessions for organization-defined auditable events.

Maps to MA-4(1) via CCI-002884

Check
Review the application documentation and interview the application administrator to identify application maintenance functions. If the application does not provide non-local maintenance and diagnostic capability, this requirement is not applicable. Identify the maintenance functions/capabilities that are provided by the application and performed by an individual which can be performed remotely. For example, the application may provide the ability to clean up a folder of temporary files, add users, remove users, restart processes, backup certain files, manage logs, or execute diagnostic sessions. Identify and open the audit logs that capture maintenance actions performed by the application. Accessing the application in the appropriate role to execute maintenance tasks, perform several maintenance tasks and observe the logs. If the application provides maintenance functions and capabilities and those functions are not logged when they are executed, this is a finding.

Fix
Configure the application to log when application maintenance functionality is executed remotely.
APSC-DV-001940 CAT II V-222562 · SRG-APP-000411

Applications used for non-local maintenance sessions must implement cryptographic mechanisms to protect the integrity of non-local maintenance and diagnostic communications.

Maps to MA-4(6) via CCI-002890

Check
Review the application documentation and interview the application administrator to identify application maintenance functions. If the application does not provide non-local maintenance and diagnostic capability, this requirement is not applicable. Identify the maintenance functions/capabilities that are provided by the application and performed by an individual which can be performed remotely. For example, the application may provide the ability to clean up a folder of temporary files, add users, remove users, restart processes, backup certain files, manage logs, or execute diagnostic sessions. Access the application in the appropriate role needed to execute maintenance tasks. Observe the manner in which the application is connecting and ensure the session is being encrypted. For example, observe the browser to ensure the session is being encrypted with TLS/SSL. If the application provides remote access to maintenance functions and capabilities and the remote access methods are not encrypted, this is a finding.

Fix
Configure the application to encrypt remote application maintenance sessions.
APSC-DV-001950 CAT II V-222563 · SRG-APP-000412

Applications used for non-local maintenance sessions must implement cryptographic mechanisms to protect the confidentiality of non-local maintenance and diagnostic communications.

Maps to MA-4(6) via CCI-003123

Check
Review the application documentation and interview the application administrator to identify application maintenance functions. If the application does not provide non-local maintenance and diagnostic capability, this requirement is not applicable. Identify the maintenance functions/capabilities that are provided by the application and performed by an individual which can be performed remotely. For example, the application may provide the ability to clean up a folder of temporary files, add users, remove users, restart processes, backup certain files, manage logs, or execute diagnostic sessions. Access the application in the appropriate role needed to execute maintenance tasks. Observe the manner in which the application is connecting and verify the session is being encrypted. For example, observe the browser to ensure the session is being encrypted with TLS/SSL. If the application provides remote access to maintenance functions and capabilities and the remote access methods are not encrypted, this is a finding.

Fix
Configure the application to encrypt remote application maintenance sessions.
APSC-DV-001960 CAT II V-222564 · SRG-APP-000413

Applications used for non-local maintenance sessions must verify remote disconnection at the termination of non-local maintenance and diagnostic sessions.

Maps to MA-4(7) via CCI-002891

Check
Review the application documentation and interview the application administrator to identify application maintenance functions. If the application does not provide non-local maintenance and diagnostic capability, this requirement is not applicable. Identify the maintenance functions/capabilities that are provided by the application, performed by an individual/admin and which can be performed remotely. Examples include but are not limited to: The application may provide the ability to clean up a folder of temporary files, add users, remove users, restart processes, backup certain files, manage logs, or execute diagnostic sessions. Identify the IP address of the source system used to originate testing traffic. The IP address will be used to identify sessions on the application host so verify traffic is not traversing a proxy connection in order to reach the application host. Access the operating system of the application host and execute the relevant OS commands to identify active TCP/IP sessions on the application host. For example, the "netstat -a" command will provide a status of all TCP/IP connections on both Windows and UNIX systems. Netstat output can be redirected to a file or the grep command can be used on UNIX systems to identify the specific application processes and network connections. netstat -a |grep -i "application process name" > filename or netstat -a |grep -i source IP address > filename Utilizing the application, access using the appropriate role needed to execute maintenance tasks. Execute a maintenance task or tasks from within the application. Re-execute the netstat commands and identify what network connections and process IDs were created to handle the new application session. Terminate the application session via the application interface and then execute the netstat commands a third time. The network connections should terminate or change to a state that indicates the connections are closed or are in the process of closing. Continue to execute netstat command until it is verified that the application has terminated the process sessions and closed the network connections. Review the application logs to ensure the application has logged the disconnection event thereby verifying the disconnection. If the application provides remote access to maintenance functions and capabilities and the remote access connections are not terminated and then verified, this is a finding.

Fix
Configure the application to verify termination of remote maintenance sessions.
APSC-DV-001970 CAT II V-222565 · SRG-APP-000185

The application must employ strong authenticators in the establishment of non-local maintenance and diagnostic sessions.

Maps to MA-4 via CCI-000877

Check
Review the application documentation and interview the application administrator to identify application maintenance functions. If the application does not provide non-local maintenance and diagnostic capability, this requirement is not applicable. Identify the maintenance functions/capabilities that are provided by the application, performed by an individual/admin and which can be performed remotely. Examples include but are not limited to: The application may provide the ability to clean up a folder of temporary files, add users, remove users, restart processes, backup certain files, manage logs, or execute diagnostic sessions. Have the application admin authenticate to the application in an administrative role and verify that strong credentials (CAC) are required to access when performing application maintenance. Have the application admin authenticate to the application host OS and verify that strong credentials (CAC) are required to access when performing application maintenance. If the application administrator is prevented from accessing the OS by policy requirement or separation of duties requirements, this is not a finding. If a CAC is not used when remotely accessing the application for maintenance or diagnostic sessions, this is a finding.

Fix
Configure the application to use strong authentication (CAC) when accessing the application for maintenance purposes.
APSC-DV-001980 CAT II V-222566 · SRG-APP-000186

The application must terminate all sessions and network connections when nonlocal maintenance is completed.

Maps to MA-4 via CCI-004190

Check
Review the application documentation and interview the system administrator to determine how the application is configured to terminate network sessions after sessions have been idle for a period of time. Identify any documented exceptions. If the application does not provide nonlocal maintenance and diagnostic capability, this requirement is Not Applicable. For privileged management sessions the period of time is 10 minutes of inactivity. For regular user or nonprivileged sessions, the period of time is 15 minutes of inactivity. Authenticate to the application using normal in-band access methods and as an application admin. Perform any operation to verify access and then leave the session idle for 10 minutes and perform no activity within the application. Access the application after the period of inactivity has expired and determine if the application still allows access. If necessary, logout of the application, clear the browser cache, and repeat the same test procedure using the account privileges of a regular user. Leave the session inactive for 15 minutes. If the application does not deny access after each user session has exceeded the relevant idle timeout period and there is no documented risk exceptions needed to fulfill mission requirements, this is a finding.

Fix
Configure the application to expire idle user sessions after 10 minutes of inactivity for admin users and after 15 minutes of inactivity for regular users.
APSC-DV-001995 CAT II V-222567 · SRG-APP-000516

The application must not be vulnerable to race conditions.

Maps to CM-6, SA-11 via CCI-000366, CCI-003178

Check
Review the application documentation and architecture. If the application is a COTS application and the vendor will not provide code review test results that demonstrate the application has been tested and is not susceptible to race conditions, the requirement is NA. Interview the application admin and identify the most recent code testing and analysis that has been conducted. Review the test results; verify configuration of analysis tools are set to check for the existence of race conditions. If race conditions are identified in the test results, verify the latest test results are being used, if not, ensure remediation has been completed. If the test results show race conditions exist and no remediation evidence is presented, or if test results are not available, this is a finding.

Fix
Be aware of potential timing issues related to application programming calls when designing and building the application. Validate that variable values do not change while a switch event is occurring.
APSC-DV-002000 CAT II V-222568 · SRG-APP-000190

The application must terminate all network connections associated with a communications session at the end of the session.

Maps to SC-10 via CCI-001133

Check
Review the application documentation and interview the system administrator to determine how the application is designed and configured to terminate network connections at the end of the application session. Identify any documented exceptions to the requirement and review associated mitigations. If the application provides a management interface for controlling or monitoring application network sessions, access that management interface. Monitor application network activity. If the application utilizes the underlying OS to control network connections, access the command prompt of the OS. Run the OS command for observing network connections at the OS. For Windows and Unix OS's, use the "netstat" command. Include command parameters that identify the application and/or process ID. netstat /? or -h provides the list of available parameters. Observe network activity and associate application processes with network connections. Repeat use of the command to identify changing network state. Determine if application session network connections are being terminated at the end of the session by observing the "state" column of the netstat command output with each iteration. If the application does not terminate network connections when application sessions end, this is a finding. If exceptions are documented with no mitigation this is a finding.

Fix
Configure or design the application to terminate application network sessions at the end of the session.
APSC-DV-002010 CAT II V-265634 · SRG-APP-000625

The application must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Maps to SC-13 via CCI-002450

Check
Review the application documentation, system security plan and interview the application administrator to determine if the application processes classified data. If the application does not process classified data, this requirement is not applicable. Identify the data classifications and the cryptographic protections established to protect the application data. Verify the application is configured to utilize the appropriate encryption based upon data classification, cryptographic tasks that need to be performed (information protection, hashing, signing) and information protection requirements. NIST-certified cryptography must be used to store classified non-Sources and Methods Intelligence (SAMI) information if required by the information owner. NSA-validated type-1 encryption must be used for all SAMI data stored in the enclave. If the application is not configured to utilize the NSA-approved cryptographic modules in accordance with data protection requirements specified in the security plan, this is a finding.

Fix
Configure application to encrypt stored classified information; Ensure encryption is performed using NIST FIPS 140-2-validated encryption. Encrypt stored, non-SAMI classified information using NIST FIPS 140-2-validated encryption. Implement NSA-validated type-1 encryption of all SAMI data stored in the enclave.
APSC-DV-002020 CAT II V-222570 · SRG-APP-000514

The application must utilize FIPS-validated cryptographic modules when signing application components.

Maps to SC-13 via CCI-002450

Check
Review the application documentation and interview the application administrator to identify the cryptographic modules used by the application. Review the application components and application requirements. Interview application developers and application admins to determine if code signing is performed on distributable application components, files or packages. For example, a developer may sign application code components or an admin may sign application files or packages in order to provide application consumers with integrity assurances. If signing has been identified in the application security plan as not being required and if a documented acceptance of risk is provided, this is not a finding. Have the application admin or the developer demonstrate how the signing algorithms are used and how signing of components including files, code and packages is performed. While SHA1 is currently FIPS-140-2 approved, due to known vulnerabilities with this algorithm, DoW PKI policy prohibits the use of SHA1 as of December 2016. See DoW CIO Memo Subject: Revised Schedule to Update DoW Public Key Infrastructure Certificates to Secure Hash Algorithm-256. If the application signing process does not use FIPS validated cryptographic modules, or if the signing process includes SHA1 or MD5 hashing algorithms, this is a finding.

Fix
Utilize FIPS-validated algorithms when signing application components.
APSC-DV-002030 CAT II V-222571 · SRG-APP-000514

The application must utilize FIPS-validated cryptographic modules when generating cryptographic hashes.

Maps to SC-13 via CCI-002450

Check
Review the application components and the application requirements to determine if the application is capable of generating cryptographic hashes. Review the application documentation and interview the application developer or administrator to identify the cryptographic modules used by the application. If hashing of application components has been identified in the application security plan as not being required and if a documented acceptance of risk is provided, this is not a finding. Have the application admin or the developer demonstrate how the application generates hashes and what hashing algorithms are used when generating a hash value. While SHA1 is currently FIPS-140-2 approved, due to known vulnerabilities with this algorithm, DoW PKI policy prohibits the use of SHA1 as of December 2016. See DoW CIO Memo Subject: Revised Schedule to Update DoW Public Key Infrastructure Certificates to Secure Hash Algorithm-256. If the application resides on a National Security System (NSS) and uses an algorithm weaker than SHA-384, this is a finding. If FIPS-validated cryptographic modules are not used when generating hashes or if the application is configured to use the MD5 or SHA1 hashing algorithm, this is a finding.

Fix
Configure the application to use a FIPS-validated hashing algorithm when creating a cryptographic hash.
APSC-DV-002040 CAT II V-222572 · SRG-APP-000514

The application must utilize FIPS-validated cryptographic modules when protecting unclassified information that requires cryptographic protection.

Maps to SC-13 via CCI-002450

Check
Interview the system administrator, review the application components, and the application requirements to determine if the application processes data requiring cryptographic protection. Review the application documentation and interview the application administrator to identify the cryptographic modules used by the application. Access the NIST site to determine if the cryptographic modules used by the application have been FIPS-validated. http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm If the application is using cryptographic modules that are not FIPS-validated to protect unclassified data, this is a finding.

Fix
Configure the application to use a FIPS-validated cryptographic module.
APSC-DV-002050 CAT II V-222573 · SRG-APP-000514

Applications making SAML assertions must use FIPS-approved random numbers in the generation of SessionIndex in the SAML element AuthnStatement.

Maps to SC-13 via CCI-002450

Check
Interview the system administrator, review the application components, and the application requirements to determine if the application uses SAML assertions. If the application does not use SAML assertions, the requirement is not applicable. Review the application documentation and interview he application administrator to identify the cryptographic modules used by the application. Access the NIST site to determine if the cryptographic modules used by the application have been FIPS-validated. http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm If the application is using cryptographic modules that are not FIPS-validated when generating the SessionIndex in the SAML AuthnStatement, this is a finding.

Fix
Configure the application to use a FIPS-validated cryptographic module.
APSC-DV-002150 CAT II V-222574 · SRG-APP-000211

The application user interface must be either physically or logically separated from data storage and management interfaces.

Maps to SC-2 via CCI-001082

Check
Review the application documentation and interview the application administrator. Review the design documents and the interfaces used by the application. Verify that the application provides separate interfaces for user traffic and for management traffic. The separation may be virtual in nature (virtual host, virtual NIC, virtual network) or physically separate. If the application user interface and the application management interface are shared, this is a finding.

Fix
Configure the application so user interface to the application and management interface to the application is separated.
APSC-DV-002210 CAT II V-222575 · SRG-APP-000219

The application must set the HTTPOnly flag on session cookies.

Maps to SC-23 via CCI-001184

Check
Review the application documentation and interview the application administrator to identify when session cookies are created. Identify any mitigating controls the application developer may have implemented. Examples include utilizing a separate Web Application Firewall that is configured to provide this capability or configuring the web server with Mod_Security or ESAPI WAF with the HTTPOnly flag directives enabled. Reference the most recent vulnerability scan documentation. Verify the configuration settings for the scan include web application checks including HTTPOnly tests. Review the scan results and determine if vulnerabilities related to HTTPOnly flag not being set for session cookies have been identified. Utilize a web browser or other web application diagnostic tool to view the session cookies the application sets on the client. Internet Explorer versions 8, 9, and 10 includes a utility called Developer tools. Access the application website and establish an application session. Access the page that sets the session cookie. Press “F12” to open Developer Tools. Select "cache" and then "view cookie information". Identify the session cookies. An example of an HTTPOnly session cookie is as follows: Set-Cookie: SessionId=z5ymkk45aworjo2l31tlhqqv; path=/; HttpOnly If the application does not set the HTTPOnly flag on session cookies or if the application administrator cannot demonstrate mitigating controls, this is a finding.

Fix
Configure the application to set the HTTPOnly flag on session cookies.
APSC-DV-002220 CAT II V-222576 · SRG-APP-000219

The application must set the secure flag on session cookies.

Maps to SC-23 via CCI-001184

Check
Review the application documentation and interview the application administrator to identify when session cookies are created. If vulnerability scan results are available, reference the most recent vulnerability scan results. Verify that the scan configuration includes checks for the secure flag on session cookies. If scan configuration settings are not available, follow the manual procedure provided below. Review the scan results and determine if the secure flag not being set was identified as a vulnerability. To manually perform the check, open a web browser, logon to the web application and use the web browser to view the new session cookie. The procedures used for viewing and clearing browser cookies will vary based upon the web browser used. Providing steps for every browser is outside the scope of the STIG. There are numerous sites that document how to view cookies using various web browsers. For IE11: Alt-X >> Internet options >> General >> Settings >> View Files A windows explorer box will open that contains the contents of the Temporary Internet Files. Browse the folder and locate the application session cookie(s). View the contents of the cookie(s). If the "secure" flag is not set on the session cookie, or if the vulnerability scan results indicate the application does not set the secure flag on cookies, this is a finding.

Fix
Configure the application to ensure the secure flag is set on session cookies.
APSC-DV-002250 CAT II V-222579 · SRG-APP-000223

Applications must use system-generated session identifiers that protect against session fixation.

Maps to SC-23(3) via CCI-001664

Check
Review the application documentation and interview the application administrator to identify how the application generates user session IDs. Application session testing is required in order to verify this requirement. Request the latest application vulnerability or penetration test results. Verify the test configuration includes session handling vulnerability tests. If the application is re-using/copying the users existing session ID that was created on one system in order to maintain user state when traversing multiple application servers in the same domain, this is not a finding. If the session testing results indicate application session IDs are re-used after the user has logged out, this is a finding.

Fix
Design the application to generate new session IDs with unique values when authenticating user sessions.
APSC-DV-002260 CAT II V-222580 · SRG-APP-000223

Applications must validate session identifiers.

Maps to SC-23(3) via CCI-001664

Check
Review the application documentation and interview the application administrator. Identify how the application validates session IDs. If using a web development framework, ask the application administrator to provide details on the framework's session configuration as it relates to session validation. If the application is not configured to validate user session identifiers, this is a finding.

Fix
Configure the application to configure user session identifiers.
APSC-DV-002270 CAT II V-222581 · SRG-APP-000223

Applications must not use URL embedded session IDs.

Maps to SC-23(3) via CCI-001664

Check
Review the application documentation and interview the application administrator. Identify how the application generates session IDs. If using a web development framework, ask the application administrator to provide details on the framework's session configuration. Review the framework configuration setting to determine how the session identifiers are created. Identify any compensating controls that may be leveraged to minimize risk to user sessions. If the framework or the application is configured to transmit cookies within the URL or via URL rewriting, or if the session ID is created using a GET method and there are no compensating controls configured to address user session security, this is a finding.

Fix
Configure the application to transmit session ID information via cookies.
APSC-DV-002280 CAT II V-222582 · SRG-APP-000223

The application must not re-use or recycle session IDs.

Maps to SC-23(3) via CCI-001664

Check
Review the application documentation and interview the application administrator to identify how the application generates user session IDs. Application session testing is required in order to verify this requirement. Request the latest application vulnerability or penetration test results. Verify the test configuration includes session handling vulnerability tests. If the application is re-using/copying the users existing session ID that was created on one system in order to maintain user state when traversing multiple application servers in the same domain, this is not a finding. If the session testing results indicate application session IDs are re-used after the user has logged out, this is a finding.

Fix
Design the application to not re-use session IDs.
APSC-DV-002290 CAT II V-222583 · SRG-APP-000224

The application must generate a unique session identifier using a FIPS 140-2/140-3 approved random number generator.

Maps to SC-23(3) via CCI-001188

Check
Review the application server configuration and documentation to determine if the application server uses a FIPS 140-2/140-3 approved random number generator to create unique session identifiers. Have a user log on to the application server to determine if the session IDs generated are random and unique. If the application server does not generate unique session identifiers and does not use a FIPS 140-2/140-3 random number generator to create the randomness of the session ID, this is a finding.

Fix
Configure the application server to generate unique session identifiers and to use a FIPS 140-2/140-3 random number generator to generate the randomness of the session identifiers.
APSC-DV-002300 CAT II V-222584 · SRG-APP-000427

The application must only allow the use of DoW-approved certificate authorities for verification of the establishment of protected sessions.

Maps to SC-23(5) via CCI-002470

Check
Review the application documentation and interview the application administrator to identify certificate location. Internet Explorer can be used to view certificate information: Select “Tools” Select “Internet Options” Select “Content” tab Select “Certificates” Select the certificate used for authentication: Click “View” Select “Details” tab Select “Issuer” If the application utilizes PKI certificates other than DoW-approved PKI and ECA certificates, this is a finding.

Fix
Configure the application to utilize DoW-approved PKI established CAs when verifying DoW-signed certificates.
APSC-DV-002320 CAT II V-222586 · SRG-APP-000226

In the event of a system failure, applications must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.

Maps to SC-24 via CCI-001665

Check
Review application documentation, interview application administrator to identify how the application logs error events. The application operational requirements documentation should provide the specific information that must be preserved in order to return the application back into operation as quickly and efficiently as possible. The application administrator will need to identify and provide the information based upon operational requirements documents. Application diagnostic information should be kept in logs for evaluation and investigation into root cause. If documentation is provided stating that no particular information needs to be retained in order to expediently bring the application back online, this is not a finding. If the application does not log the data required to determine root cause of application failure, or if information specified as required in order to expediently bring the application back online is not retained, this is a finding.

Fix
Create operational configuration documentation that identifies information needed for the application to return back into service or specify no such data is required, and retain data required to determine root cause of application failures.
APSC-DV-002330 CAT II V-222587 · SRG-APP-000231

The application must protect the confidentiality and integrity of stored information when required by DoW policy or the information owner.

Maps to SC-28 via CCI-001199

Check
Review the application documentation and interview the application administrator. Identify the data processed by the application and the accompanying data protection requirements. Determine if the data owner has specified stored data protection requirements. Determine if the application is processing publicly releasable, CUI, or classified stored data. Determine if the application configuration information contains sensitive information. Access the data repository and have the application administrator, application developer, or designer identify the data integrity and confidentiality protections used to protect stored data. If the application processes classified data or the data owner has specified data protection requirements and the application administrator is unable to demonstrate how the data is protected, this is a finding.

Fix
Identify data elements that require protection. Document the data types and specify protection requirements and methods used.
APSC-DV-002360 CAT II V-222590 · SRG-APP-000233

The application must isolate security functions from non-security functions.

Maps to SC-3 via CCI-001084

Check
Review the application documentation and interview the application administrator. Identify if the application utilizes access controls. Commonly employed access controls include Role-Based Access Controls (RBAC), Access Control Lists (ACL) and Mandatory Access Controls (MAC). Ensure the application utilizes a control structure that is capable of protecting security assets such as policy and configuration settings from unauthorized modification. If the application does not protect security functions that enforce security policy and protect security configuration settings, this is a finding.

Fix
Implement controls within the application that limits access to security configuration functionality and isolates regular application function from security-oriented function.
APSC-DV-002370 CAT II V-222591 · SRG-APP-000431

The application must maintain a separate execution domain for each executing process.

Maps to SC-39 via CCI-002530

Check
Review the application documentation, the architecture documentation and interview the application administrator. Identify if the application architecture provides the capability to sandbox executing processes so as to prevent a process in one application domain from sharing another application domain. Ask the application administrator to demonstrate how the application processes are separated. This may be demonstrated by examining the OS processes running on the system and identifying the separate application processes. If the application does not maintain a separate execution domain for each executing process, this is a finding.

Fix
Design and configure applications to maintain a separate execution domain for each executing process.
APSC-DV-002380 CAT II V-222592 · SRG-APP-000243

Applications must prevent unauthorized and unintended information transfer via shared system resources.

Maps to SC-4 via CCI-001090

Check
Review the application documentation and interview the application administrator to identify if the application shares information resources via file sharing protocol or if the application includes configuration settings that provide access to data files on the hard drive. Also determine if the application transfers data via shared system resources. If the application shares system resources with other applications, verify that a security boundary exists which controls and prevents other applications, processes, or users from accessing application data. The control mechanism will vary based upon the resource that is being shared. Hard disk sharing could possibly utilize file permissions restrictions, whereas shared overall system resources could implement virtualization or containers that restrict access. If the application does not prevent unauthorized and unintended information transfer via shared system resources, this is a finding.

Fix
Configure or design the application to utilize a security control that will implement a boundary that will prevent unauthorized and unintended information transfer via shared system resources.
APSC-DV-002390 CAT II V-222593 · SRG-APP-000435

XML-based applications must mitigate DoS attacks by using XML filters, parser options, or gateways.

Maps to SC-5 via CCI-002385

Check
Review the application architecture documentation and interview the application administrator to identify what steps have been taken to protect the XML aspect of the application from DoS attacks. If the application does not contain or utilize XML, the requirement is not applicable. Ask the application administrator to demonstrate how the application is configured to provide the following protections: - Validation against recursive payloads - Validation against oversized payloads - Protection against XML entity expansion - Validation against overlong element names - Optimized configuration for maximum message throughput If the application administrator cannot demonstrate how these protections are implemented either within the application itself or by third-party tools or utilities like an XML gateway, this is a finding.

Fix
Implement: - Validation against recursive payloads - Validation against oversized payloads - Protection against XML entity expansion - Validation against overlong element names - Optimized configuration for maximum message throughput in order to ensure DoS attacks against web services are limited.
APSC-DV-002400 CAT II V-222594 · SRG-APP-000246

The application must restrict the ability to launch Denial of Service (DoS) attacks against itself or other information systems.

Maps to SC-5(1) via CCI-001094

Check
Review the application documentation and interview the application administrator. Ask the application administrator if any anti-DoS technology or anti-DoS emergency response services are deployed to protect the application. Check for code review, penetration or vulnerability test results that attempt to DoS the application or use the application as a DoS tool. Examine test results and testing configuration to ensure that the application was tested and the application was not reported as being susceptible to DoS attacks either from external sources or from the application itself. Also verify the testing results show that the application cannot be weaponized to attack other systems. If the test results indicate the application is susceptible to DoS attacks or can be weaponized to attack other applications or systems, this is a finding.

Fix
Design and deploy the application to utilize controls that will prevent the application from being affected by DoS attacks or being used to attack other systems. This includes but is not limited to utilizing throttling techniques for application traffic such as QoS or implementing logic controls within the application code itself that prevents application use that results in network or system capabilities being exceeded.
APSC-DV-002410 CAT II V-222595 · SRG-APP-000247

The web service design must include redundancy mechanisms when used with high-availability systems.

Maps to SC-5(2) via CCI-001095

Check
Interview the application administrator and review the system documentation to determine if the application has been designated as a high availability system and if the application is designed to operate in a high availability environment. If the application has not been designated as a high availability system, this requirement is not applicable. Review the application architecture documentation and identify solutions that provide application DoS protections. Verify the application has been built to work in a clustered or otherwise high availability environment in accordance with documented availability requirements. This includes: - load balancers - redundant systems such as multiple web, application servers or DB servers - high bandwidth or redundant data circuits - multiple data centers (geographic dispersal) - server clusters If the application has been designated as high availability but the architecture is not built to high availability standards, this is a finding.

Fix
Build the application to address issues that are found in a redundant environment and utilize redundancy mechanisms to provide high availability.
APSC-DV-002450 CAT II V-222597 · SRG-APP-000440

The application must implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS).

Maps to SC-8(1) via CCI-002421

Check
Review the application documentation, the application architecture designs and interview the application administrator. Ask the application admin to identify the network path taken by the application data and demonstrate the application support integrity mechanisms for transmission of both incoming and outgoing files and any transmitted data. For example, hashing/digital signature and cyclic redundancy checks (CRCs) can be used to confirm integrity on data streams and transmitted files. Use of TLS can be used to assure integrity in point-to-point communication sessions. When the application uses messaging or web services or other technologies where the data can traverse multiple hops, the individual message or packet must be encrypted to protect the integrity of the message. If the application is not configured to provide cryptographic protections to application data while it is transmitted unless protected by alternative safety measures like a PDS, this is a finding.

Fix
Configure the application to use cryptographic protections to prevent unauthorized disclosure of application data based upon the application architecture.
APSC-DV-002460 CAT II V-222598 · SRG-APP-000441

The application must maintain the confidentiality and integrity of information during preparation for transmission.

Maps to SC-8(2) via CCI-002420

Check
Review the application documentation and interview the application administrator. Identify web servers and associated network connections. Access the application with a web browser. Verify the web browser goes secure automatically by automatically redirecting the browser to a secure port running TLS encryption, or ensure the port used by the application uses TLS encryption by default. For tiered applications, (web server, application server, database server) verify the communication channels between the tiers is also encrypted. If the application does not utilize TLS to protect the confidentiality and integrity of transmitted information, this is a finding.

Fix
Configure all of the application systems to require TLS encryption.
APSC-DV-002470 CAT II V-222599 · SRG-APP-000442

The application must maintain the confidentiality and integrity of information during reception.

Maps to SC-8(2) via CCI-002422

Check
Review the application documentation and interview the application administrator. Identify web servers and associated network connections. Access the application with a web browser. Verify the web browser goes secure automatically by automatically redirecting the browser to a secure port running TLS encryption, or ensure the port used by the application uses TLS encryption by default. For tiered applications, (web server, application server, database server) ensure the communication channels between the tiers is also encrypted. If the application does not utilize TLS to protect the confidentiality and integrity of transmitted information, this is a finding.

Fix
Configure all of the application systems to require TLS encryption.
APSC-DV-002480 CAT II V-222600 · SRG-APP-000441

The application must not disclose unnecessary information to users.

Maps to SC-8(2) via CCI-002420

Check
Review the application system documentation and interview the application administrators. Ask them to demonstrate how the web server and application configuration does not disclose any information about the application which could be used by an attacker to gain access to the application. Ask the application representative to logon as a non-privileged user and review all screens of the application to identify any potential data that should not be disclosed to the user. Review web server configuration and determine if custom error pages are configured to display on error events. Review error pages sent to application users to verify the pages are generic in nature and provide no technical details related to application architecture. If the application displays any application technical data such as database version, application server information, or any other technical details that should not be disclosed to a regular user, this is a finding.

Fix
Configure the application to not display technical details about the application architecture on error events.
APSC-DV-002500 CAT II V-222603 · SRG-APP-000251

The application must protect from Cross-Site Request Forgery (CSRF) vulnerabilities.

Maps to SI-10 via CCI-001310

Check
Review the application documentation, the code review reports and the vulnerability assessment scan results from the automated vulnerability assessment tools. Verify scan configuration settings include web-based application settings which include XSS tests. Review the scan results for CSRF vulnerabilities. If the scan results indicate aspects of the application are vulnerable to CSRF, request subsequent scan data that shows the CSRF vulnerabilities previously detected have been fixed. If results that show compliance are not available, request proof of any steps that have been taken to mitigate the risk. Mitigation steps include using web reputation filters to identify sources of exploits delivered via CSRF, web application firewalls that validate cookie and the referrer field in the HTTP headers, or product specific IPS filters that identify and intercept known CSRF vulnerabilities in web-based applications. If scan results are not available ask the application administrator to provide evidence that shows the application is designed to address CSRF security issues. There are various methods for mitigating the risk, including using a challenge token that is tied to the users session. If application scan results show an unremediated CSRF vulnerability, or if no scan results are available, or no mitigations have been enabled, this is a finding.

Fix
Configure the application to use unpredictable challenge tokens and check the HTTP referrer to ensure the request was issued from the site itself. Implement mitigating controls as required such as using web reputation services.
APSC-DV-002520 CAT II V-222605 · SRG-APP-000251

The application must protect from canonical representation vulnerabilities.

Maps to SI-10 via CCI-001310

Check
Review the application documentation and interview the application administrator for details regarding security assessment code reviews or vulnerability scans. Review the scan results from the entire application. This can be provided as results from an automated code review or a vulnerability scanning tool. Review the scan results to determine if there are any existing canonical representation vulnerabilities. Review web server and application configuration. The OWASP website provides the following test procedures: "Investigate the web application to determine if it asserts an internal code page, locale, or culture. If the default character set, locale is not asserted it will be one of the following: HTTP Posts. Interesting tidbit: All HTTP posts are required to be ISO 8859-1, which will lose data for most double byte character sets. You must test your application with your supported browsers to determine if they pass in fully encoded double byte characters safely HTTP Gets. Depends on the previously rendered page and per-browser implementations, but URL encoding is not properly defined for double byte character sets. IE can be optionally forced to do all submits as UTF-8 which is then properly canonicalized on the server .NET: Unicode (little endian) JSP implementations, such as Tomcat: UTF8 - see “javaEncoding” in web.xml by many servlet containers Java: Unicode (UTF-16, big endian, or depends on the OS during JVM startup) PHP: Set in php.ini, ISO 8859-1” If the results are not provided or the application representative cannot demonstrate that the application does not use Unicode encoding, this is a finding.

Fix
A suitable canonical form should be chosen and all user input canonicalized into that form before any authorization decisions are performed. Security checks should be carried out after decoding is completed. Moreover, it is recommended to check that the encoding method chosen is a valid canonical encoding for the symbol it represents.
APSC-DV-002530 CAT II V-222606 · SRG-APP-000251

The application must validate all input.

Maps to SI-10 via CCI-001310

Check
Review the application documentation, the code review reports and the vulnerability assessment scan results from automated vulnerability assessment tools. Verify scan configuration settings include input validation and fuzzing tests. Test data entry fields on all pages/screens of the application. Procedures on testing input are relevant to the architecture of the application. A reference on input validation testing is included at the OWASP website. The site includes testing procedures for input validation that affect many different technologies. Identify the relevant testing procedures based upon the application architecture and components being tested. https://www.owasp.org/index.php/Testing_for_Input_Validation If test results include input validation errors, or if no test results exist, this is a finding.

Fix
Design and configure the application to validate input prior to executing commands.
APSC-DV-002570 CAT II V-222610 · SRG-APP-000266

The application must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

Maps to SI-11 via CCI-001312

Check
Review the application documentation and interview the application administrator for details regarding how the application displays error messages. Utilize the application as a non-privileged user and attempt to execute functionality that will generate error messages. Review the error messages displayed to ensure no sensitive information is provided to end users. If error messages are designed to provide users with just enough detail to pass along to support staff in order to aid in troubleshooting such as date, time, or other generic information, this is not a finding. If variable names, SQL strings, system path information, or source or program code are displayed in error messages sent to non-privileged users, this is a finding.

Fix
Configure the server to not send error messages containing system information or sensitive data to users. Use generic error messages.
APSC-DV-002580 CAT II V-222611 · SRG-APP-000267

The application must reveal error messages only to the ISSO, ISSM, or SA.

Maps to SI-11 via CCI-001314

Check
Review the application documentation and interview the application administrator for details regarding how the application displays error messages. Authenticate to the application as a non-privileged user and attempt to execute functionality that will generate error messages. Review the error messages displayed to ensure no sensitive information is provided to end users. Authenticate as a privileged user and repeat tests. If error messages are designed to provide users with just enough detail to pass along to support staff in order to aid in troubleshooting such as date, time or other generic information, this is not a finding. If detailed error messages are provided to privileged users, this is not a finding. If variable names, SQL strings, system path information, or source or program code are displayed in error messages sent to non-privileged users, this is a finding.

Fix
Configure the server to only send error messages containing system information or sensitive data to privileged users. Use generic error messages for non-privileged users.
APSC-DV-002610 CAT II V-222613 · SRG-APP-000454

The application must remove organization-defined software components after updated versions have been installed.

Maps to SI-2(6) via CCI-002617

Check
Review the application documentation and interview the application admin to identify application locations on system. Identify application versions that are installed on the system. Review the file system structure to see if older versions of the application are still installed. If old versions of the application or components are still installed on the system, this is a finding.

Fix
Configure or design the application to remove old components when updating.
APSC-DV-002630 CAT II V-222614 · SRG-APP-000456

Security-relevant software updates and patches must be kept up to date.

Maps to SI-2 via CCI-002605

Check
Review the application documentation to identify application versions and patching. Interview the application administrator and inquire about patching process. Review IAVMs and CTOs to determine if the application is being updated in accordance with authoritative sources. If application updates are not checked on at least on a weekly basis and applied immediately or in accordance with POA&Ms, IAVMs, CTOs, DTMs or other authoritative patching guidelines or sources, this is a finding.

Fix
Check for application updates at least weekly and apply patches immediately or in accordance with POA&Ms, IAVMs, CTOs, DTMs or other authoritative patching guidelines or sources.
APSC-DV-002760 CAT II V-222615 · SRG-APP-000472

The application performing organization-defined security functions must verify correct operation of security functions.

Maps to SI-6 via CCI-002696

Check
Review the application documentation and interview the system administrator to determine if the application performs security function testing. If the application is not designed or intended to perform security function testing, the requirement is not applicable. Access the application design documents and determine if the application is designed to verify the correct operation of security functions. Review application logs and take note of log entries that indicate security function testing is being performed and verified. If the application is designed to perform security function testing and does not verify the correct operation of security functions, this is a finding.

Fix
Design the application to verify the correct operation of security functions.
APSC-DV-002770 CAT II V-222616 · SRG-APP-000473

The application must perform verification of the correct operation of security functions: upon system startup and/or restart; upon command by a user with privileged access; and/or every 30 days.

Maps to SI-6 via CCI-002699

Check
Review the application documentation and interview the system administrator to determine if the application performs security function testing. If the application is not designed or intended to perform security function testing, the requirement is not applicable. Access the application design documents or have the system administrator provide proof if the application is designed to verify the correct operation of security functions. Review application logs and take note of log entries that indicate security function testing is being performed and verified on startup, restart, or on command by an authorized user. If the application is designed to perform security function testing and does not verify the correct operation of security functions on startup, restart, or upon command by a privileged user, this is a finding.

Fix
Design the application to verify the correct operation of security functions on command and on application startup and restart.
APSC-DV-002870 CAT II V-222618 · SRG-APP-000206

Unsigned Category 1A mobile code must not be used in the application in accordance with DoW policy.

Maps to SC-18(1) via CCI-001166

Check
Review the application documentation and interview the application administrator to identify any mobile code that is provided by the application for client consumption. If the application does not contain mobile code, or if the mobile code executes within the client browser, this is not applicable. The URL of the application must be added to the Trusted Sites zone. This is accomplished via the Tools, Internet Options, and “Security” Tab. Select the “Trusted Sites” zone. Click the “sites” button. Enter the URL into the text box below the “Add this site to this zone” message. Click "Add”. Click “OK”. Note: This requires administrator privileges to add URL to sites on a STIG compliant workstation. Next, test the application. This testing should include functional testing from all major components of the application. If mobile code is in use, the browser will prompt to download the control. At the download prompt, the browser will indicate that code has been digitally signed. If the code has not been signed or the application warns that a control cannot be invoked due to security settings, this is a finding.

Fix
Configure the application so Category 1A mobile code is signed.
APSC-DV-002880 CAT II V-222619 · SRG-APP-000516

The ISSO must ensure an account management process is implemented, verifying only authorized users can gain access to the application, and individual accounts designated as inactive, suspended, or terminated are promptly removed.

Maps to AC-2 via CCI-002121

Check
Interview the application representative to verify that a documented process exists for user and system account creation, termination, and expiration. Obtain a list of recently departed personnel and verify that their accounts were removed or deactivated on all systems in a timely manner (e.g., less than two days). If a documented account management process does not exist or unauthorized users have active accounts, this is a finding.

Fix
Establish an account management process.
APSC-DV-002900 CAT II V-222621 · SRG-APP-000516

The ISSO must ensure application audit trails are retained for at least 30 months (12 months active + 18 months cold storage) for applications without SAMI data and five years for applications including SAMI data.

Maps to AU-11 via CCI-000167

Check
Verify a process is in place to retain application audit log files for 30 months (12 months active + 18 months cold storage) for non-SAMI data and five years for SAMI data. If audit logs have not been retained for 30 months (12 months active + 18 months cold storage) or five years for SAMI data, this is a finding.

Fix
Retain application audit log files for 30 months (12 months active + 18 months cold storage) for non-SAMI data and five years for SAMI data.
APSC-DV-002910 CAT II V-222622 · SRG-APP-000516

The ISSO must review audit trails periodically based on system documentation recommendations or immediately upon system security events.

Maps to AU-6(10) via CCI-001872

Check
Interview the application representative and ask for the system documentation that states how often audit logs are reviewed. Also, determine when the audit logs were last reviewed. If the application representative cannot provide system documentation identifying how often the auditing logs are reviewed, or has not audited within the last time period stated in the system documentation, this is a finding.

Fix
Establish a scheduled process for reviewing logs. Maintain a log or records of dates and times audit logs are reviewed.
APSC-DV-002920 CAT II V-222623 · SRG-APP-000516

The ISSO must report all suspected violations of IA policies in accordance with DoW information system IA procedures.

Maps to AU-6 via CCI-000149

Check
Interview the application representative and review the SOPs to ensure that violations of IA policies are analyzed and reported. If there is no policy for reporting IA violations, this is a finding.

Fix
Create and maintain a policy to report IA violations.
APSC-DV-002930 CAT II V-222624 · SRG-APP-000516

The ISSO must ensure active vulnerability testing is performed.

Maps to CA-2(2) via CCI-000256

Check
Ask the application representative to provide vulnerability test procedures and vulnerability test results. Ask the application representative to provide the settings that were used to conduct the vulnerability testing. Verify the automated vulnerability scanning tool was appropriately configured to ensure as complete a test as possible of the application architecture components (e.g., if the application includes a web server, web server tests must be included). If the vulnerability scan report includes informational and/or noncritical results, this is not a finding. If previously identified vulnerabilities have subsequently been resolved, this is not a finding. If the application test procedures and test results do not include active vulnerability and fuzz testing, this is a finding. If the vulnerability scan results include critical vulnerabilities 21 business days or older, this is a finding. If the vulnerability scanning tests are not relevant to the architecture of the application, this is a finding.

Fix
Perform active vulnerability and fuzz testing of the application. Verify the vulnerability scanning tool is configured to test all application components and functionality. Address discovered vulnerabilities.
APSC-DV-002950 CAT II V-222625 · SRG-APP-000516

Execution flow diagrams and design documents must be created to show how deadlock and recursion issues in web services are being mitigated.

Maps to CM-4(2), CM-6 via CCI-000336, CCI-000366

Check
Review the application documentation and the system diagrams detailing application system to system and service to service communication methods. Interview the application admin to identify any application web services that are deployed by the application. If the application does not deploy web services, the requirement is not applicable. If the application consumes web services but is not responsible for development of the services, the requirement is not applicable. Review the data flow diagrams and the system documentation to determine if the issue of web service deadlock is addressed. If the issue is not addressed in the documentation or configuration settings, ask the application admin to demonstrate how deadlock issues are addressed. If deadlock issues are not being addressed via documented web service configuration or design, this is a finding.

Fix
Develop web services to account for deadlock issues.
APSC-DV-002960 CAT II V-222626 · SRG-APP-000516

The designer must ensure the application does not store configuration and control files in the same directory as user data.

Maps to CM-5 via CCI-000345

Check
Review the application documentation and interview the application administrator. Ask the application administrator or examine the application documentation to determine the file location of the application configuration settings and user data. Identify the directory where the application code, configuration settings and other application control data are located. Identify where user data is stored. Examine file permissions to application folder. If the application user data is located in the same directory as the application configuration settings or control files, or if the file permissions allow application users write access to application configuration settings, this is a finding.

Fix
Separate the application user data into a different directory than the application code and user file permissions to restrict user access to application configuration settings.
APSC-DV-002970 CAT II V-222627 · SRG-APP-000516

The ISSO must ensure if a DoW STIG or NSA guide is not available, a third-party product will be configured by following available guidance.

Maps to CM-6 via CCI-000363

Check
Review the application documentation to identify application name, features and version. Identify if a DoW STIG or NSA guide is available. If no STIG is available for the product, the application and application components must be configured by the following as available: - commercially accepted practices, - independent testing results, or - vendor literature and lock down guides. If the application and application components do not have DoW STIG or NSA guidance available and are not configured according to: commercially accepted practices, independent testing results, or vendor literature and lock down guides, this is a finding.

Fix
Configure the application according to the product STIG or when a STIG is not available, utilize: - commercially accepted practices, - independent testing results, or - vendor literature and lock down guides.
APSC-DV-002980 CAT II V-222628 · SRG-APP-000516

New IP addresses, data services, and associated ports used by the application must be submitted to the appropriate approving authority for the organization, which in turn will be submitted through the DoW Ports, Protocols, and Services Management (DoW PPSM)

Maps to CM-7(3) via CCI-000388

Check
All application ports, protocols, and services needed for application operation need to be in compliance with the DoW Ports and Protocols guidance. Check: http://iase.disa.mil/ppsm/Pages/index.aspx to verify the ports, protocols, and services are in compliance with the PPS CAL. Check all necessary ports and protocols needed for application operation (only those accessed from outside the local enclave) are checked against the DoW Ports and Protocols guidance to ensure compliance. Identify the ports needed for the application: - Look at System Security Plan/Accreditation documentation - Ask System Administrator - Go to Network Administrator - Go to Network Reviewer - If a network scan is available, use it - Use netstat/task manager - Check /etc./services If the application is not in compliance with DoW Ports and Protocols guidance, this is a finding.

Fix
Verify the accreditation documentation lists all interfaces and the ports, protocols, and services used. Verify that all ports, protocols, and services are used in accordance with the DoW PPSM.
APSC-DV-002990 CAT II V-222629 · SRG-APP-000516

The application must be registered with the DoW Ports and Protocols Database.

Maps to CM-7(3) via CCI-000388

Check
Verify registration of the application and ports in the Ports and Protocols Database for a production site. If the application requires registration, and is not registered or all ports used have not been identified in the database, this is a finding.

Fix
Register the application and ports in the Ports and Protocols Database.
APSC-DV-002995 CAT II V-222630 · SRG-APP-000516

The Configuration Management (CM) repository must be properly patched and STIG compliant.

Maps to CM-9 via CCI-001795

Check
Review the application system documentation and interview the application administrator. Identify if the STIG is being applied to application developers or organizations responsible for code management or who have and operate an application CM repository. If this is not the case, the requirement is not applicable. Review CM patch management processes and procedures. Have the system and CM admins demonstrate their patch management processes and verify the system has the latest security patches applied. Review the ATO documentation and verify the system that operates the CM repository software has had all relevant STIGs applied. If CM repository is not at the latest security patch level and is not operating on a STIG compliant system, this is a finding.

Fix
Patch the CM system when new security patches are made available and apply the relevant STIGs.
APSC-DV-003000 CAT II V-222631 · SRG-APP-000516

Access privileges to the Configuration Management (CM) repository must be reviewed every three months.

Maps to CM-9 via CCI-001795

Check
Review the application system documentation. Interview the application administrator. Identify if development of the application is done in house and if application configuration management repository exists. If application development is not done in house and if a code configuration management repository does not exist, the requirement is not applicable. Review CM management processes and procedures. Verify the CM repository access permissions are reviewed at least every three months. Ask the application administrator or the CM administrator when the last time the CM access privileges were reviewed. If CM access privileges have not been reviewed within the last three months, this is a finding.

Fix
Review access privileges to the CM repository at least every three months.
APSC-DV-003010 CAT II V-222632 · SRG-APP-000516

A Software Configuration Management (SCM) plan describing the configuration control and change management process of application objects developed by the organization and the roles and responsibilities of the organization must be created and maintained.

Maps to CM-9 via CCI-001795

Check
Interview ISSM or application administrator. Identify if development of the application is done in house and if application configuration management repository exists. If application development is not done in house and if a code configuration management repository does not exist, the requirement is not applicable. Verify the SCM plan identifies all objects created during the development process subject to configuration control. Verify the SCM plan maintains procedures for identifying individual application components, as well as, entire application releases during all phases of the software development lifecycle. Verify the SCM plan identifies and tracks all actions and changes resulting from a change request from initiation to release. Verify the SCM plan contains procedures to identify, document, review, and authorize any change requests to the application. Verify the SCM plan defines the responsibilities, the actions to be performed, the tools, techniques and methodologies, and defines an initial set of base-lined software components. Verify the SCM plan objects have security classifications labels if processing classified data. Verify the SCM plan identifies tools and version numbers used in the software development lifecycle. Verify the SCM plan identifies mechanisms for controlled access of simultaneous individuals updating the same application component. Verify the SCM plan assures only authorized changes by authorized persons are possible. Verify the SCM plan identifies mechanisms to control access and audit changes between different versions of objects subject to configuration control. Verify the SCM plan identifies mechanisms to track and audit all modifications of objects under configuration control. Audits will include the originator and date and time of the modification. Ask the application representative to review the applications SCM plan. The SCM plan should contain the following: - Description of the configuration control and change management process - Types of objects developed - Roles and responsibilities of the organization - Defined responsibilities - Actions to be performed - Tools used in the process - Techniques and methodologies - Initial set of baselined software components If the SCM plan does not include the above, this is a finding. The SCM plan should identify all objects that are under configuration management control. Ask the application representative to provide access to the CMR and to identify the objects shown in the SCM plan. If the application representative cannot display all types of objects under CMR control, this is a finding. The SCM plan should identify third-party tools and respective version numbers. If the SCM plan does not identify third-party tools, this is a finding. The SCM plan should identify mechanisms for controlled access of individuals simultaneously updating the same application component. If the SCM plan does not identify mechanisms for controlled access, this is a finding. The SCM plan assures only authorized changes by authorized persons are allowed. If the SCM plan does not assure only authorized changes are made, this is a finding. The SCM plan should identify the mechanisms used to control access and audit changes between different versions of objects subject to CMR control. If the SCM plan does not identify mechanisms used to control access and to audit changes between different versions of objects subject to CMR control, this is a finding. The SCM plan should have procedures for label versions of application components and application builds under configuration management control. Ask the application representative to demonstrate the CMR and ensure it contains versions and releases of the application. Ask the application representative to create a build or demonstrate a current release of the application that can be recreated. If the application representative cannot display releases and application component versions, this is a finding. The CMR should track change requests from beginning to end. Ask the application representative to display a completed or in-process change request. If the CMR cannot track change requests, this is a finding. If the application has just completed its first release, there may not be any change requests logged in the CMR. In this case, this finding is not applicable. The CMR should authorize change requests to the application. Ask the application representative to display an authorized change request and identify who is responsible for authorizing change requests. If the CMR does not track authorized change requests, this is a finding. If the application has just completed its first release, there may not be any change requests logged in the CMR. In this case, this finding is not applicable. The CMR should contain security classification labels for code and documentation in the repository. Classification labels are not applicable to unclassified systems. If the applications managed by the CMR are not classified, this requirement is not applicable. If the CMR manages classified applications and there are no classification labels of code and documentation in the CMR, this is a finding. The CMR should audit all objects under CM control for modification. If the CMR does not audit for modifications, this is a finding.

Fix
Create and update a SCM plan describing the configuration control and change management process of application objects developed by the organization and the roles and responsibilities of the organization. Configure CMR to comply.
APSC-DV-003020 CAT II V-222633 · SRG-APP-000516

A Configuration Control Board (CCB) that meets at least every release cycle, for managing the Configuration Management (CM) process must be established.

Maps to CM-9 via CCI-001795

Check
Interview the application representative and determine if application development is performed on site by the organization. If application development is not done in house, the requirement is not applicable. If so, determine if a CCB exists. Ask about the membership of the CCB, and identify the primary members. Ask if there is CCB charter documentation. Interview the application representative and determine how often the CCB meets. Ask if there is CCB charter documentation. The CCB charter documentation should indicate how often the CCB meets. If there is no charter documentation, ask when the last time the CCB met and when was the last release of the application. CCBs do not have to physically meet, and the CCB chair may authorize a release based on phone and/or e-mail conversations. If there is no evidence of CCB activity or meetings prior to the last release cycle, this is a finding.

Fix
Setup and maintain a Configuration Control Board.
APSC-DV-003030 CAT II V-222634 · SRG-APP-000387

The application services and interfaces must be compatible with and ready for IPv6 networks.

Maps to CP-11 via CCI-002853

Check
Verify the application environment is compliant with all DoW IPv6 Standards Profile for IPv6 Capable Products guidance for servers. If the application environment is not compliant with all DoW IPv6 Standards Profile for IPv6 Capable Products guidance for servers, this is a finding.

Fix
Design application to be compliant with all Department of Defense (DoD) Information Technology Standards Registry (DISR) IPv6 profiles.
APSC-DV-003040 CAT II V-222635 · SRG-APP-000516

The application must not be hosted on a general purpose machine if the application is designated as critical or high availability by the ISSO.

Maps to CP-2(8) via CCI-002828

Check
Ask the application representative to review the servers where the application is deployed. Ask what other applications are deployed on those servers. Identify the criticality of the applications installed on the system. If a mission critical application is deployed onto the same server as non-mission critical applications, this is a finding.

Fix
Deploy mission critical applications on servers that are not shared by other less critical applications.
APSC-DV-003050 CAT II V-222636 · SRG-APP-000516

A contingency plan must exist in accordance with DoW policy based on the application's availability requirements.

Maps to CP-2 via CCI-000445

Check
Review contingency plans. For high availability applications, verify the contingency plan exists and provides for the smooth transfer of all mission or business essential functions to an alternate site for the duration of an event with little or no loss of operational continuity. For moderate availability applications, verify the contingency plan exists and provides for the resumption of mission or business essential functions within 12 hours activation or as defined in the contingency plan. For low availability applications, verify the contingency plan exists and provides for the partial resumption of mission or business essential functions within 5 to 30 days of activation as defined in the contingency plan. If the contingency plan does not exist or does not meet the severity level requirements, this is a finding.

Fix
Create and maintain a contingency plan that identifies essential mission and business functions and associated contingency requirements.
APSC-DV-003060 CAT II V-222637 · SRG-APP-000516

Recovery procedures and technical system features must exist so recovery is performed in a secure and verifiable manner. The ISSO will document circumstances inhibiting a trusted recovery.

Maps to CP-2 via CCI-000448

Check
Review disaster recovery plan. Verify that a disaster recovery plan is in place for the application. Verify that the recovery procedures include any special considerations for trusted recovery. If the application is not part of the site’s disaster recovery plan, or if any special considerations for trusted recovery are not documented, this is a finding.

Fix
Create and maintain a disaster recovery plan.
APSC-DV-003070 CAT II V-222638 · SRG-APP-000516

Data backup must be performed at required intervals in accordance with DoW policy.

Maps to CP-9 via CCI-000537

Check
Interview the application and system admins and review documented backup procedures. Check the following based on the risk level of the application. For low risk applications: Validate backup procedures exist and are performed at least weekly. A sampling of system backups should be checked to ensure compliance with the control. For medium risk applications: Validate backup procedures exist and are performed at least daily. Validate recovery media is stored at an off-site location and ensure the data is protected in accordance with its risk category and confidentiality level. This validation can be performed by examining an SLA or MOU/MOA that states the protection levels of the data and how it should be stored. A sampling of system backups should be checked to ensure compliance with the control. Verify that the organization tests backup information to ensure media reliability and information integrity. Verify that the organization selectively uses backup information in the restoration of information system functions as part of annual contingency plan testing. For high risk applications: Validate that the procedures have been defined for system redundancy and they are properly implemented and are executing the procedures. Verify that the redundant system is properly separated from the primary system (i.e., located in a different building or in a different city). This validation should be performed by examining the secondary system and ensuring its operation. Examine the SLA or MOU/MOA to ensure redundant capability is addressed. Finding details should indicate the type of validation performed. Examine the mirror capability testing procedures and results to insure the capability is properly tested at 6 month minimum intervals. If any of the requirements above for the associated risk level of the application are not met, this is a finding.

Fix
Develop and implement backup procedures based on risk level of the system and in accordance with DoW policy.
APSC-DV-003080 CAT II V-222639 · SRG-APP-000516

Back-up copies of the application software or source code must be stored in a fire-rated container or stored separately (offsite).

Maps to CP-9 via CCI-000540

Check
When reviewing a COTS or GOTS application, verify that a back-up copy of the software is stored in a fire rated container or is stored separately (offsite) from the operational environment. Determine if application development is done in-house. If application development occurs in-house and source code is available, verify a back-up copy of the source code is kept in a fire-rated container or stored offsite from the development environment. If back-up copies of the application software or source code are not stored in a fire-rated container or stored separately (offsite) from their respective environments, this is a finding.

Fix
Store a back-up copy of the application software and source code in a fire-rated container or store it separately (offsite) from their respective environments.
APSC-DV-003090 CAT II V-222640 · SRG-APP-000516

Procedures must be in place to assure the appropriate physical and technical protection of the backup and restoration of the application.

Maps to CP-9 via CCI-000540

Check
Validate that backup and recovery procedures incorporate protection of the backup and restoration assets. Verify assets housing the backup data (e.g., SANS, tapes, backup directories, software) and the assets used for restoration (e.g., equipment and system software) are included in the backup and recovery procedures. If backup and restoration devices are not included in the recovery procedures, this is a finding.

Fix
Develop and implement procedures to insure that backup and restoration assets are properly protected and stored in an area/location where it is unlikely they would be affected by an event that would affect the primary assets.
APSC-DV-003100 CAT II V-222641 · SRG-APP-000516

The application must use encryption to implement key exchange and authenticate endpoints prior to establishing a communication channel for key exchange.

Maps to IA-5(6) via CCI-000201

Check
If the application does not implement key exchange, this check is not applicable. Identify all application or supporting infrastructure features using key exchange. Verify the application is using FIPS-140-2 validated cryptographic modules for encryption of keys during key exchange. If the application does not implement encryption for key exchange, this is a finding.

Fix
Use encryption for key exchange.
APSC-DV-003140 CAT II V-222645 · SRG-APP-000516

Application files must be cryptographically hashed prior to deploying to DoW operational networks.

Maps to SA-10(1) via CCI-000698

Check
Ask the application representative to demonstrate their cryptographic hash validation process or provide process documentation. The validation process will vary based upon the operating system used as there are numerous clients available that will display a file's cryptographic hash for validation purposes. Linux operating systems include the "sha256sum" utility. For Linux systems using sha256sum command syntax is: sha256sum [OPTION]... [FILE]... Recent Windows PowerShell versions include the "get-filehash" PowerShell cmdlet. The default algorithm value used is SHA256. Syntax is: Get-FileHash [-Path] [-Algorithm ] [] A validation process involves obtaining the application files’ cryptographic hash value from the programs author or other authoritative source such as the application's website. A utility like the "sha256sum" utility is then run using the downloaded application file name as the argument. The output is the files' hash value. The two hash values are compared and if they match, then file integrity is ensured. If the application being reviewed is a COTS product and the vendor used a SHA1 or MD5 algorithm to generate a hash value, this is not a finding. If the application being reviewed is a COTS product and the vendor did not provide a hash value for validating the package, this is not a finding. If the integrity of the application files/code is not validated prior to deployment to DoW operational networks, this is a finding.

Fix
Developers/release managers create cryptographic hash values of application files and/or application packages prior to transitioning the application from test to a production environment. They protect cryptographic hash information so it cannot be altered and make a read copy of the hash information available to application Admins so they can validate application packages and files after they download the files. Application Admins validate cryptographic hashes prior to deploying the application to production.
APSC-DV-003150 CAT II V-222646 · SRG-APP-000516

At least one tester must be designated to test for security flaws in addition to functional testing.

Maps to SA-11(2) via CCI-003182

Check
Review the organization chart and interview the admin staff. Identify personnel designated as application security testers. If the organization operating the application is not doing development work, this requirement is not applicable. If the organization has not designated personnel to conduct security testing, this is a finding.

Fix
Designate personnel to conduct security testing on the applications.
APSC-DV-003170 CAT II V-222648 · SRG-APP-000516

An application code review must be performed on the application.

Maps to SA-11(4) via CCI-003187

Check
This requirement is meant to apply to developers or organizations that are doing the application development work and have the responsibility for maintaining the application source code. Otherwise, the requirement is not applicable. Review the system documentation and ask the application representative to describe the code review process or provide documentation outlining the organizations code review process. If code reviews are conducted with software tools, have the application representative provide the latest code review report for the application. Ensure the code review looks for all known security flaws including but not limited to: - format string exploits - memory leaks - buffer overflows - race conditions - sql injection - dead/unused/commented code - input validation exploits If the organization does not conduct code reviews on the application that attempt to identify all known and potential security issues, or if code review results are not available for review, this is a finding.

Fix
Conduct and document code reviews on the application during development and identify and remediate all known and potential security vulnerabilities prior to releasing the application.
APSC-DV-003190 CAT II V-222650 · SRG-APP-000516

Flaws found during a code review must be tracked in a defect tracking system.

Maps to SA-10 via CCI-003161

Check
This requirement is meant to apply to developers or organizations that are doing application development work. If application development is not being done or managed by the organization, this requirement is not applicable. Ask the application representative to demonstrate that the configuration management repository captures flaws in the code review process. The configuration management repository may consist of a separate application for capturing code defects. If there is no configuration management repository or the code review flaws are not captured in the configuration management repository, this is a finding.

Fix
Track software defects in a defect tracking system.
APSC-DV-003200 CAT II V-222651 · SRG-APP-000516

The changes to the application must be assessed for IA and accreditation impact prior to implementation.

Maps to SA-11 via CCI-003173

Check
Interview the application and system administrators and determine if changes to the application are assessed for IA impact prior to implementation. Review the CCB process documentation to ensure potential changes to the application are evaluated to determine impact. An informal group may be tasked with impact assessment of upcoming version changes. If IA impact analysis is not performed, this is a finding.

Fix
Review IA impact to the system prior to implementing changes.
APSC-DV-003210 CAT II V-222652 · SRG-APP-000516

Security flaws must be fixed or addressed in the project plan.

Maps to SA-11 via CCI-003178

Check
This requirement is meant to apply to developers or organizations that are doing application development work. If the organization managing the application is not performing or managing the development of the application the requirement is not applicable. Ask the application representative to demonstrate how security flaws are integrated into the project plan. If security flaws are not addressed in the project plan or there is no process to introduce security flaws into the project plan, this is a finding.

Fix
Address security flaws within a project plan to ensure they are tracked and addressed by management.
APSC-DV-003230 CAT II V-222655 · SRG-APP-000516

Threat models must be documented and reviewed for each application release and updated as required by design and functionality changes or when new threats are discovered.

Maps to SA-15(4) via CCI-003256

Check
This requirement is meant to apply to developers or organizations that are doing application development work. If the organization operating the application is not doing the development or is not managing the development of the application, the requirement is not applicable. Review the threat model document and identify the following sections are present: - Identified threats - Potential vulnerabilities - Counter measures taken - Potential mitigations - Mitigations selected based on risk analysis Review the identified threats, vulnerabilities, and countermeasures. Countermeasures could include implementing application firewalls or IDS/IPS and configuring certain IDS filters. Review the application documentation. Verify the architecture and components of the application match with the components in the threat model document. Verify identified threats and vulnerabilities are addressed or mitigated and the ISSO and ISSM have reviewed and approved the document. If the described threat model documentation does not exist, this is a finding.

Fix
Establish and maintain threat models and review for each application release and when new threats are discovered. Identify potential mitigations to identified threats. Verify mitigations are implemented to threats based on their risk analysis.
APSC-DV-003235 CAT II V-222656 · SRG-APP-000516

The application must not be subject to error handling vulnerabilities.

Maps to SA-15(5) via CCI-003272

Check
Review the application documentation, code review reports and the results from static code analysis tools. Identify the most recent security scans and code analysis testing conducted. Verify testing configuration includes tests for error handling issues. Check test results for identified error handling vulnerabilities within the application. If the test results indicate the existence of error handling vulnerabilities and no remediation evidence is presented, this is a finding. If no test results are available for review, this is a finding.

Fix
Ensure proper return code and exception handling is implemented throughout the application.
APSC-DV-003236 CAT II V-222657 · SRG-APP-000516

The application development team must provide an application incident response plan.

Maps to SA-15(10) via CCI-003289

Check
If the application is a COTS application and the development team is not accessible to interview this requirement is not applicable. Interview the application development team members. Request and review the application incident response plan. Ensure the plan includes an implemented process that: - Tracks reported vulnerabilities and bugs - Confirms reported vulnerabilities and bugs - Tracks remediation effort - Notifies application users of available updates that address the reported issues. If the application incident response plan does not exist and at a minimum does not implement the aforementioned processes, this is a finding.

Fix
The development team creates an application incident response plan documenting and establishing a process that at a minimum: - Tracks reported vulnerabilities and bugs - Confirms reported vulnerabilities and bugs - Tracks remediation effort - Notifies application users of available updates that address the reported issues.
APSC-DV-003270 CAT II V-222661 · SRG-APP-000516

Unnecessary built-in application accounts must be disabled.

Maps to SA-4(5) via CCI-003109

Check
Review the application documentation and identify if the application creates or utilizes built-in accounts. Examine the account list for obvious examples (e.g., accounts with vendor names such as Oracle or Tivoli). Verify that these accounts have been removed or disabled. If enabled built-in accounts are present, ask the application representative the reason for their existence. If the account is required in order for the application to operate properly, verify the account password has been changed to a DoW acceptable value. If these accounts are not necessary to run the application, or if the accounts are required and the password has not been changed to meet DoW password requirements, this is a finding.

Fix
Disable unnecessary built-in userids, use other strong authentication when possible and use strong passwords if accounts are necessary for application operation.
APSC-DV-003285 CAT II V-222663 · SRG-APP-000516

An Application Configuration Guide must be created and included with the application.

Maps to SA-5 via CCI-003124

Check
Interview the application administrator. Request and review the Application Configuration Guide. Verify the configuration guide at a minimum provides configuration details for the following examples. The examples provided herein are not intended to limit the configuration settings that are documented in the guide. Configuration examples include but are not limited to: - Encryption Settings - PKI Certificate Configuration Settings - Password Settings - Auditing configuration - AD configuration - Backup and disaster recovery settings - List of hosting enclaves and network connection requirements - Deployment configuration settings - Known security assumptions, implications, system level protections, best practices, and required permissions Review the Application Configuration Guide and determine if development systems are documented. If no development is being performed where the application is hosted, this part of the requirement is NA. Development systems, build systems, and test systems must operate in a standardized environment. Examples include but are not limited to: - List of development systems, build systems, and test systems. - Versions of compilers used - Build options when creating applications and components - Versions of COTS software (used as part of the application) - Operating systems and versions - For web applications, which browsers and what versions are supported. If there is no application configuration guide included with the application, this is a finding.

Fix
Create the application configuration guide in accordance with configuration examples provided in the vulnerability discussion and check. Verify the application configuration guide is distributed along with the application.
APSC-DV-003290 CAT II V-222664 · SRG-APP-000516

If the application contains classified data, a Security Classification Guide must exist containing data elements and their classification.

Maps to SA-5 via CCI-003124

Check
If the application does not process classified information, this check is not applicable. The application may already be covered by a higher level program or other classification guide. If the classification guide is not written specifically to the application, the sensitive application data should be reviewed to determine whether it is contained in the classification guide. DOD 5200.01 Volume 1 identifies requirements for security classification and declassification guides. https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/520001m_vol1.pdf Security classification guides must provide the following information: Identify specific items, elements, or categories of information to be protected. State the specific classification to be assigned to each item or element of information and, when useful, specify items of information that are unclassified. Provide declassification instructions for each item or element of information, including the applicable exemption category for information exempted from automatic declassification. State a concise reason for classification for each item, element, or category of information that, at a minimum, cites the applicable classification categories in Section 1.5 of E.O. 12958. Identify any special handling caveats that apply to items, elements, or categories of information. Identify, by name or personal identifier and position title, the original classification authority approving the guide and the date of that approval. Provide a point of contact for questions about the guide and suggestions for improvement. For information exempted from automatic declassification because its disclosure would reveal foreign government information or violate a statute, treaty, or international agreement, the security classification guide will identify the government or specify the applicable statute, treaty, or international agreement, as appropriate. If the security classification guide does not exist, or does not contain application data elements and their classification, this is a finding.

Fix
Create and maintain a security classification guide.
APSC-DV-003300 CAT II V-222665 · SRG-APP-000516

The designer must ensure uncategorized or emerging mobile code is not used in applications.

Maps to SC-18(2) via CCI-001167

Check
Review the application documentation and interview application administrator. Determine what mobile code types are used by the application. If uncategorized mobile code types are found, ask the application administrator to provide the documented waiver and risk acceptance. If the application is using uncategorized or emerging mobile code and there is no waiver provided, this is a finding.

Fix
Remove uncategorized or emerging mobile code from the application or obtain a waiver and risk acceptance to operate.
APSC-DV-003310 CAT II V-222666 · SRG-APP-000516

Production database exports must have database administration credentials and sensitive data removed before releasing the export.

Maps to SC-28(2) via CCI-002478

Check
Review the application documentation and identify the existence of databases within the application architecture. Ask the application admin to identify when data exports from this database are imported to test or development databases. If no data is exported to test or development databases, this check is not applicable. If there are such data exports, ask if the production database includes sensitive data identified by the data owner as sensitive such as passwords, financial, personnel, personal, HIPAA, Privacy Act, or classified data is included. If any database exports include sensitive data and that data is not sanitized or removed prior to or immediately after import to the development database, this is a finding.

Fix
Remove sensitive data from production database exports.
APSC-DV-003320 CAT II V-222667 · SRG-APP-000516

Protections against DoS attacks must be implemented.

Maps to SC-5 via CCI-002386

Check
Ask the application representative for the threat model document. Examine the threat model document and determine if DoS attacks are specified as a threat. If there are no DoS threats identified in the threat model, the requirement is not applicable. Verify the mitigations provided for DoS attacks are implemented from the threat model. If mitigations for DoS attacks are identified in the threat model but are not implemented, this is a finding.

Fix
Implement mitigations from the threat model for DOS attacks.
APSC-DV-003330 CAT II V-222668 · SRG-APP-000516

The system must alert an administrator when low resource conditions are encountered.

Maps to SI-4(12) via CCI-001274

Check
Review the system documentation and interview the application and system administrators. Examine the system to determine if an automated, continuous on-line monitoring and audit trail creation capability is present with the capability to immediately alert personnel of any unusual or inappropriate activity with potential IA implications, and with a user configurable capability to automatically disable the system if serious IA violations are detected. If this monitoring capability does not exist, this is a finding.

Fix
Implement mechanisms to alert system administrators about a low resource condition.
APSC-DV-003350 CAT II V-222671 · SRG-APP-000516

Connections between the DoW enclave and the Internet or other public or commercial wide area networks must require a DMZ.

Maps to SC-7(13) via CCI-001119

Check
Interview the application representative and determine if the application is publicly accessible. If the application is publicly accessible and traffic is not being routed through a DMZ, this is a finding.

Fix
Setup a DMZ between DoW and public networks.
APSC-DV-003400 CAT II V-222673 · SRG-APP-000516

The Program Manager must verify all levels of program management, designers, developers, and testers receive annual security training pertaining to their job function.

Maps to AT-3(3) via CCI-002052

Check
This requirement is meant to be applied to developers and development teams only, otherwise, this requirement is not applicable. Interview the application representative. Ask for evidence of annual security training for application managers, designers, developers, and testers. Examples of evidence include course completion certificates and a class roster. At a minimum, security training should include security awareness training pertaining to overall principles of secure application development. Training must be in addition to DoD 8570 training requirements as DoD 8570 annual security training does not presently cover application SDLC security concerns. If there is no evidence of security training, this is a finding.

Fix
Provide application development/operational related security specific annual training for managers, designers, developers, and testers.

Applications STIGs

CAT II 230

The application must provide a capability to limit the number of logon sessions per user.

The application must clear temporary storage and cookies when the session is terminated.

The application must automatically terminate the non-privileged user session and log off non-privileged users after a 15 minute idle time period has elapsed.

The application must automatically terminate the admin user session and log off admin users after a 10 minute idle time period is exceeded.

Applications requiring user access authentication must provide a logoff capability for user initiated communication session.

The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in storage.

The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in process.

The application must associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission.

The application must implement DoW-approved encryption to protect the confidentiality of remote access sessions.

The application must implement cryptographic mechanisms to protect the integrity of remote access sessions.

Applications with SOAP messages requiring integrity must include the following message elements:-Message ID-Service Request-Timestamp-SAML Assertion (optionally included in messages) and all elements of the message must be digitally signed.

The application must ensure each unique asserting party provides unique assertion ID references for each SAML assertion.

The application must ensure encrypted assertions, or equivalent confidentiality protections are used when assertion data is passed through an intermediary, and confidentiality of the assertion data is required when passing through the intermediary.

The application must ensure if a OneTimeUse element is used in an assertion, there is only one of the same used in the Conditions element portion of an assertion.

The application must ensure messages are encrypted when the SessionIndex is tied to privacy data.

The application must provide automated mechanisms for supporting account management functions.

Shared/group account credentials must be terminated when members leave the group.

The application must automatically remove or disable temporary user accounts 72 hours after account creation.

Unnecessary application accounts must be disabled, or deleted.

The application must automatically audit account creation.

The application must automatically audit account modification.

The application must automatically audit account disabling actions.

The application must automatically audit account removal actions.

The application must automatically audit account enabling actions.

Application data protection requirements must be identified and documented.

The application must utilize organization-defined data mining detection techniques for organization-defined data storage objects to adequately detect data mining attempts.

The application must enforce organization-defined discretionary access control policies over defined subjects and objects.

The application must enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

The application must enforce approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.

The application must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

The application must audit the execution of privileged functions.

The application administrator must follow an approved process to unlock locked user accounts.

The application must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.

The application must provide audit record generation capability for the creation of session IDs.

The application must provide audit record generation capability for the destruction of session IDs.

The application must provide audit record generation capability for the renewal of session IDs.

The application must not write sensitive data into the application logs.

The application must provide audit record generation capability for session timeouts.

The application must record a time stamp indicating when the event occurred.

The application must provide audit record generation capability for HTTP headers including User-Agent, Referer, GET, and POST.

The application must provide audit record generation capability for connecting system IP addresses.

The application must record the username or user ID of the user associated with the event.

The application must generate audit records when successful/unsuccessful attempts to grant privileges occur.

The application must generate audit records when successful/unsuccessful attempts to access security objects occur.

The application must generate audit records when successful/unsuccessful attempts to access security levels occur.

The application must generate audit records when successful/unsuccessful attempts to access categories of information (e.g., classification levels) occur.

The application must generate audit records when successful/unsuccessful attempts to modify privileges occur.

The application must generate audit records when successful/unsuccessful attempts to modify security objects occur.

The application must generate audit records when successful/unsuccessful attempts to modify security levels occur.

The application must generate audit records when successful/unsuccessful attempts to modify categories of information (e.g., classification levels) occur.

The application must generate audit records when successful/unsuccessful attempts to delete privileges occur.

The application must generate audit records when successful/unsuccessful attempts to delete security levels occur.

The application must generate audit records when successful/unsuccessful attempts to delete application database security objects occur.

The application must generate audit records when successful/unsuccessful attempts to delete categories of information (e.g., classification levels) occur.

The application must generate audit records when successful/unsuccessful logon attempts occur.

The application must generate audit records for privileged activities or other system-level access.

The application must generate audit records showing starting and ending time for user access to the system.

The application must generate audit records when successful/unsuccessful accesses to objects occur.

The application must generate audit records for all direct access to the information system.

The application must generate audit records for all account creations, modifications, disabling, and termination events.

The application must initiate session auditing upon startup.

The application must log application shutdown events.

The application must log destination IP addresses.

The application must log user actions involving access to data.

The application must log user actions involving changes to data.

The application must produce audit records containing information to establish when (date and time) the events occurred.

The application must produce audit records containing enough information to establish which component, feature or function of the application triggered the audit event.

When using centralized logging; the application must include a unique identifier in order to distinguish itself from other application logs.

The application must produce audit records that contain information to establish the outcome of the events.

The application must generate audit records containing information that establishes the identity of any individual or process associated with the event.

The application must generate audit records containing the full-text recording of privileged commands or the individual identities of group account users.

The application must implement transaction recovery logs when transaction based.

The application must provide centralized management and configuration of the content to be captured in audit records generated by all application components.

The application must off-load audit records onto a different system or media than the system being audited.

The application must be configured to write application logs to a centralized log repository.

The application must provide an immediate warning to the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of repository maximum audit record storage capacity.

Applications categorized as having a moderate or high impact must provide an immediate real-time alert to the SA and ISSO (at a minimum) for all audit failure events.

The application must alert the ISSO and SA (at a minimum) in the event of an audit processing failure.