STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must ensure encrypted assertions, or equivalent confidentiality protections are used when assertion data is passed through an intermediary, and confidentiality of the assertion data is required when passing through the intermediary.

DISA Rule

SV-222402r508029_rule

Vulnerability Number

V-222402

Group Title

SRG-APP-000014

Rule Version

APSC-DV-000220

Severity

CAT II

CCI(s)

• CCI-000068 - The information system implements cryptographic mechanisms to protect the confidentiality of remote access sessions.

Weight

10

Fix Recommendation

Encrypt assertions or use equivalent confidentiality when sensitive assertion data is passed through an intermediary.

Check Contents

Ask the application representative for the design document.

Review the design document for web services using WS-Security tokens.

If the application does not utilize WS-Security tokens, this check is not applicable.

Verify all WS-Security tokens are transmitted via an approved encryption method.

If the design document does not exist, or does not indicate all WS-Security tokens are only transmitted via an approved encryption method, this is a finding.

Vulnerability Number

V-222402

Documentable

False

Rule Version

APSC-DV-000220

Severity Override Guidance

Ask the application representative for the design document.

Review the design document for web services using WS-Security tokens.

If the application does not utilize WS-Security tokens, this check is not applicable.

Verify all WS-Security tokens are transmitted via an approved encryption method.

If the design document does not exist, or does not indicate all WS-Security tokens are only transmitted via an approved encryption method, this is a finding.

Check Content Reference

M

Target Key

4093

Comments