Applications STIGs

CAT III 22

Any vulnerability, the existence of which degrades measures to protect against loss of confidentiality, availability or integrity.

1. APSC-DV-000100 CAT III V-222392 · SRG-APP-000297

   The application must display an explicit logoff message to users indicating the reliable termination of authenticated communications sessions.

   Maps to AC-12(2) via CCI-002364
   Check

   If the application does not provide an interface for interactive user access, this is not applicable. Log on to the application with a valid user account. Examine the user interface. Identify the command or link that provides the logoff function. Activate the user logoff function. If the application does not provide an explicit logoff message indicating the user session has been terminated, this is a finding.

   Fix

   Design and configure the application to provide an explicit logoff message to users indicating a successful logoff has occurred upon user session termination.

2. APSC-DV-000310 CAT III V-222410 · SRG-APP-000516

   The application must have a process, feature or function that prevents removal or disabling of emergency accounts.

   Maps to CM-6 via CCI-000366
   Check

   Review the application documentation and interview the application administrator. Identify if emergency accounts are ever used. If emergency accounts are not used, this requirement is not applicable. If emergency accounts are used, validate a procedure, process, feature or function exists that will prevent the emergency account from being deleted or disabled during a crisis situation. Examples include but are not limited to adding a flag to the account to ensure it is not deleted during a specified emergency period or placing the account in a designated group that is monitored and controlled in accordance with the crisis. If a process, procedure, function or feature designed to prevent emergency accounts from being deleted or disabled during a crisis situation is not available, this is a finding.

   Fix

   Identify accounts that are created in an emergency situation and ensure procedures or processes are in place to prevent disabling or deleting the account while the emergency is underway.

3. APSC-DV-000320 CAT III V-222411 · SRG-APP-000025

   The application must automatically disable accounts after a 35 day period of account inactivity.

   Maps to AC-2(3) via CCI-000017
   Check

   Examine the application documentation or interview the application representative to identify how the application users are managed. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory (AD) for user management or if the application manages user accounts within the application. If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is not applicable. If the application handles the management tasks for user accounts, access the applications user management utility. Navigate to the screen where user accounts are configured to be disabled after 35 days of inactivity. Confirm this setting is active. If the application is not set to expire inactive accounts after 35 days, or if the application has no ability to expire accounts after 35 days of inactivity, this is a finding.

   Fix

   Design and configure the application to expire user accounts after 35 days of inactivity.

4. APSC-DV-000380 CAT III V-222417 · SRG-APP-000291

   The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are created.

   Maps to AC-2(1), AC-2(4) via CCI-000015, CCI-001683
   Check

   Review the application and system documentation. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application. If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is Not Applicable. Ensure the application is configured to notify SAs when new accounts are created by identifying SAs who will be notified, creating a test account, and checking with SAs to verify the notification was received. If SAs and ISSOs are not notified when accounts are created, this is a finding.

   Fix

   Configure the application to notify the SA and the ISSO when application accounts are created.

5. APSC-DV-000390 CAT III V-222418 · SRG-APP-000292

   The application must notify system administrators (SAs) and information system security officers (ISSOs) when accounts are modified.

   Maps to AC-2(1), AC-2(4) via CCI-000015, CCI-001684
   Check

   Review the application and system documentation. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application. If the application is configured to use an enterprise-based application user management capability that is STIG compliant, this requirement is Not Applicable. Ensure the application is configured to notify SAs when accounts are modified by identifying the SAs who will be notified when accounts are modified. Modify a test account and check with a SA to verify the notification was received. If SAs and ISSOs are not notified when accounts are modified, this is a finding.

   Fix

   Configure the application to notify the SA and the ISSO when application accounts are modified.

6. APSC-DV-000400 CAT III V-222419 · SRG-APP-000293

   The application must notify system administrators (SAs) and information system security officers (ISSOs) of account disabling actions.

   Maps to AC-2(1), AC-2(4) via CCI-000015, CCI-001685
   Check

   Review the application and system documentation. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application. If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is Not Applicable. Ensure the application is configured to notify SAs when accounts are disabled by identifying the SAs who will be notified when accounts are disabled. Disable a test account and check with a SA to verify the notification was received. If SAs and ISSOs are not notified when accounts are disabled, this is a finding.

   Fix

   Configure the application to notify the SA and the ISSO when application accounts are disabled.

7. APSC-DV-000410 CAT III V-222420 · SRG-APP-000294

   The application must notify system administrators (SAs) and information system security officers (ISSOs) of account removal actions.

   Maps to AC-2(1), AC-2(4) via CCI-000015, CCI-001686
   Check

   Review the application and system documentation. Interview the application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application. If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is Not Applicable. Ensure the application is configured to notify SAs when accounts are removed by identifying the SAs who will be notified when accounts are removed. Remove a test account and check with a SA to verify the notification was received. If SAs and ISSOs are not notified when accounts are removed, this is a finding.

   Fix

   Configure the application to notify the SA and the ISSO when application accounts are removed.

8. APSC-DV-000430 CAT III V-222422 · SRG-APP-000320

   The application must notify system administrators (SAs) and information system security officers (ISSOs) of account enabling actions.

   Maps to AC-2(1), AC-2(4) via CCI-000015, CCI-002132
   Check

   Review the application and system documentation. Interview application administrator and determine if the application is configured to utilize a centralized user management system like Active Directory for user management or if the application manages user accounts within the application. If the application is configured to use an enterprise-based application user management capability that is STIG compliant, the requirement is Not Applicable. Ensure the application is configured to notify SAs when accounts are enabled by identifying the SAs who will be notified when accounts are enabled. Disable and then enable a test account and check with the SA to verify the notification was received to indicate the account was enabled. If SAs and ISSOs are not notified when accounts are enabled, this is a finding.

   Fix

   Configure the application to notify the SA and the ISSO when application accounts are enabled.

9. APSC-DV-000550 CAT III V-222434 · SRG-APP-000068

   The application must display the Standard Mandatory DoW Notice and Consent Banner before granting access to the application.

   Maps to AC-8 via CCI-000048
   Check

   If the application has no interactive user interface, this requirement is not applicable. Log on to the application as a user. Observe the screen and ensure the DoW-approved banner is displayed prior to obtaining access to the application. Refer to the vulnerability discussion for the approved text. If the only way to access the application is through the OS console, e.g., a fat client application installed on a GFE desktop or laptop, and that GFE is configured to display the DoW banner, an additional banner is not required at the application level. If the standard DoW-approved banner is not displayed prior to obtaining access, this is a finding.

   Fix

   Configure the application to present the standard DoW-approved banner prior to granting access to the application.

10. APSC-DV-000560 CAT III V-222435 · SRG-APP-000069

    The application must retain the Standard Mandatory DoW Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.

    Maps to AC-8 via CCI-000050
    Check

    If the application has no interactive user interface, this requirement is not applicable. If the user interface is only available via the OS console, e.g., a fat client application installed on a GFE desktop or laptop, and that GFE is configured to display the DoW banner, this requirement is not applicable. Access the application and authenticate if necessary. Verify the banner is displayed and action must be taken to accept terms of use. If the banner is not displayed or no action must be taken to accept terms of use, this is a finding.

    Fix

    Configure the application to retain the standard DoW-approved banner until the user accepts the usage conditions prior to granting access to the application.

11. APSC-DV-000570 CAT III V-222436 · SRG-APP-000070

    The publicly accessible application must display the Standard Mandatory DoW Notice and Consent Banner before granting access to the application.

    Maps to AC-8 via CCI-001384, CCI-001385, CCI-001386, CCI-001387, CCI-001388
    Check

    This requirement only applies to publicly accessible applications. If the application is not publicly accessible, this requirement is not applicable. Access the application and observe the screen to ensure the DoW-approved banner is displayed prior to obtaining full access to the application. Refer to the vulnerability discussion for the approved banner text. If the standard DoW-approved banner is not displayed prior to obtaining access, this is a finding.

    Fix

    Configure the application to present the standard DoW-approved banner prior to granting access to the application.

12. APSC-DV-000580 CAT III V-222437 · SRG-APP-000075

    The application must display the time and date of the users last successful logon.

    Maps to AC-9 via CCI-000052
    Check

    Review the application documentation and interview the application administrator. If the application does not provide a user interface, this requirement is not applicable. Logon to the application as a test user and verify successful authentication by creating test data, navigating the application functionality or otherwise utilizing the application. Note the date and time access was granted. Log out of the application. Re-authenticate to the application as the same user. Validate the last logon date and time is displayed in the user interface. If the date and time the user account was last granted access to the application is not displayed in the user interface, this is a finding.

    Fix

    Design and configure the application to display the date and time when the user was last successfully granted access to the application.

13. APSC-DV-002780 CAT III V-222617 · SRG-APP-000275

    The application must notify the ISSO and ISSM of failed security verification tests.

    Maps to SI-6 via CCI-001294
    Check

    Review the application documentation and interview the system administrator to determine if the application performs security function testing. If the application is not designed or intended to perform security function testing, the requirement is not applicable. Access the application design documents or have the system administrator provide proof the application is designed to verify the correct operation of security functions. Review application logs and take note of log entries that indicate security function testing is being performed and verified on startup, restart, or on command by an authorized user. Review logs to identify if the application has sent notifications to ISSO and ISSM when security verification tests fail. Review application features and function to identify areas of the management interfaces that specify where failed security verifications tests are to be sent and validate the ISSO and ISSM are configured as recipients. If the application is designed to perform security function testing and does not notify the ISSO and ISSM of failed verification tests, this is a finding.

    Fix

    Configure the application to send notices to the ISSO and ISSM indicating the application failed a verification test.

14. APSC-DV-003130 CAT III V-222644 · SRG-APP-000516

    Prior to each release of the application, updates to system, or applying patches; tests plans and procedures must be created and executed.

    Maps to PM-14 via CCI-003004
    Check

    If the review is not being done with the developer of the application, this requirement is not applicable. Ask the application representative to provide tests plans, procedures, and results to ensure they are updated for each application release or updates to system patches. If test plans, procedures, and results do not exist, or are not updated for each application release, this is a finding.

    Fix

    Execute tests plans prior to release or patch update.

15. APSC-DV-003160 CAT III V-222647 · SRG-APP-000516

    Test procedures must be created and at least annually executed to ensure system initialization, shutdown, and aborts are configured to verify the system remains in a secure state.

    Maps to SA-11(2) via CCI-003182
    Check

    Review the process documentation and interview the admin staff. Identify if testing procedures exist and if they include annual testing to ensure the application remains in a secure state on initialization, shutdown, and aborts. Checks should include at a minimum, attempts to access the application and application configuration settings without credentials or with improper credentials both locally and remotely. Dates should be noted as to the last date of testing. If annual testing procedures do not exist, or if administrators are unable to provide testing dates that indicate the tests were conducted within the last year, this is a finding.

    Fix

    Create test procedures to test the security state of the application and exercise test procedures annually.

16. APSC-DV-003180 CAT III V-222649 · SRG-APP-000516

    Code coverage statistics must be maintained for each release of the application.

    Maps to SA-11(4) via CCI-003188
    Check

    If the organization does not do or manage the application development work for the application, this requirement is not applicable. Ask the application representative to provide code coverage statistics maintained for the application. If these code coverage statistics do not exist, this is a finding.

    Fix

    Track application testing and maintain statistics that show how much of the application function was tested.

17. APSC-DV-003215 CAT III V-222653 · SRG-APP-000516

    The application development team must follow a set of coding standards.

    Maps to SA-15 via CCI-003233
    Check

    This requirement is meant to apply to developers or organizations that are doing application development work. If the organization operating the application under review is not doing the development or managing the development of the application, the requirement is not applicable. Ask the application representative about their coding standards. Ask for a coding standards document, review the document and ask the developers if they are aware of and if they use the coding standards. Make a determination if the application developers follow the coding standard. If the developers do not follow a coding standard, or if a coding standard document does not exist, this is a finding.

    Fix

    Create and maintain a coding standard process and documentation for developers to follow. Include programming best practices based on the languages being used for application development. Include items that should be standardized across the team that deals with how developers write their application code.

18. APSC-DV-003220 CAT III V-222654 · SRG-APP-000516

    The designer must create and update the Design Document for each release of the application.

    Maps to SA-15 via CCI-003233
    Check

    This requirement is meant to apply to developers or organizations that are doing application development work. If the organization operating the application is not doing the development or managing the development of the application, the requirement is not applicable. Ask the application representative for the design document for the application. Review the design document. Examine the design document and/or the threat model for the application and verify the following information is documented: - All external interfaces. - The nature of information being exchanged - Any protections on the external interface - User roles required for access control and the access privileges assigned to each role - Unique security requirements (e.g., encryption of key data elements at rest) - Categories of sensitive information processed by the application and their specific protection plans (e.g., PII, HIPAA). - Restoration priority of subsystems, processes, or information - Verify the organization includes documentation describing the design and implementation details of the security controls employed within the information system with sufficient detail - Application incident response plan that provides details on how to provide the development team with application vulnerability or bug information. If the design document is incomplete, this is a finding.

    Fix

    Create and maintain the Design Document for each release of the application and identify the following: - All external interfaces (from the threat model) - The nature of information being exchanged - Categories of sensitive information processed or stored and their specific protection plans - The protection mechanisms associated with each interface - User roles required for access control - Access privileges assigned to each role - Unique application security requirements - Categories of sensitive information processed or stored and specific protection plans (e.g., Privacy Act, HIPAA, etc.) - Restoration priority of subsystems, processes, or information.

19. APSC-DV-003260 CAT III V-222660 · SRG-APP-000516

    Procedures must be in place to notify users when an application is decommissioned.

    Maps to SA-22 via CCI-003374
    Check

    Interview the application representative to determine if provisions are in place to notify users when an application is decommissioned. If provisions are not in place to notify users when an application is decommissioned, this is a finding.

    Fix

    Create and establish procedures to notify users when an application is decommissioned.

20. APSC-DV-003340 CAT III V-222669 · SRG-APP-000516

    At least one application administrator must be registered to receive update notifications, or security alerts, when automated alerts are available.

    Maps to SI-5 via CCI-001285
    Check

    Review the components of the application. Ask the application representative to demonstrate deployment personnel are registered to receive notifications for update notification for all of the application components including custom-developed software, libraries and third-party tools. If no deployment personnel are registered to receive the alerts, this is a finding.

    Fix

    Register administrators to receive update notifications so they can patch and update applications and application components.

21. APSC-DV-003345 CAT III V-222670 · SRG-APP-000516

    The application must provide notifications or alerts when product update and security related patches are available.

    Maps to SI-5 via CCI-001286
    Check

    Review the components of the application. Interview the application administrator. Have the application administrator demonstrate the application notification process that occurs when a security patch or product update is available. The process must include a brief description of the issue and any potential risks related to the issue. The process must also include information regarding the availability of the patch or update and how it can be obtained as well as any potential mitigations that can be utilized in the interim. If there is no application security patch or update notification process, this is a finding. If the application notification process does not include a brief description, information on risks, how to obtain the patch or update and any potential mitigations, this is a finding.

    Fix

    Provide a distribution mechanism for obtaining updates to the application. Include a description of the issue, a summary of risk as well as potential mitigations and how to obtain the update.

22. APSC-DV-003360 CAT III V-222672 · SRG-APP-000506

    The application must generate audit records when concurrent logons from different workstations occur.

    Maps to AU-12 via CCI-000172
    Check

    Review the application documentation and interview the application administrator to identify where log records are stored. Access log records then log on to the application as a regular user from one workstation. Take note of workstation IP address and confirm the address as the source workstation. Have the application administrator log on to the application from another workstation using the same account. Validate the IP address of the second workstation is recorded in the logs. If the application does not create an audit record when concurrent logons occur from different workstations, this is a finding.

    Fix

    Configure the application to log concurrent logons from different workstations.