STIGQter STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

Shared/group account credentials must be terminated when members leave the group.

DISA Rule

SV-222408r508029_rule

Vulnerability Number

V-222408

Group Title

SRG-APP-000317

Rule Version

APSC-DV-000290

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Create a procedure for deleting either member accounts or the entire group account when members leave the group.

Check Contents

Review the application documentation and determine if there is a requirement for shared or group accounts.

If there is no official requirement for shared or group application accounts, this requirement is not applicable.

Interview the application representative and identify shared/group accounts.

Have the application representative provide their procedures for account management as it pertains to group users.

Validate there is a procedure for deleting either member accounts or the entire group account when member leave the group.

If there is no process for handling group account credentials, this is a finding.

Vulnerability Number

V-222408

Documentable

False

Rule Version

APSC-DV-000290

Severity Override Guidance

Review the application documentation and determine if there is a requirement for shared or group accounts.

If there is no official requirement for shared or group application accounts, this requirement is not applicable.

Interview the application representative and identify shared/group accounts.

Have the application representative provide their procedures for account management as it pertains to group users.

Validate there is a procedure for deleting either member accounts or the entire group account when member leave the group.

If there is no process for handling group account credentials, this is a finding.

Check Content Reference

M

Target Key

4093

Comments