STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020: STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:SV-222466r508029_rule
V-222466
SRG-APP-000508
APSC-DV-000870
CAT II
10
Configure the application to log all direct access to the system.
Review the application documentation and interview the application administrator.
Identify if the application implements a direct access feature or function that allows users to directly access the underlying OS.
Direct access includes but is not limited to: executing OS commands, navigating the file system, manipulating system resources such as print queues, or reading files hosted on the OS that are not specifically shared or made available on the website.
If the application does not provide direct access to the system, this requirement is not applicable.
Access the application logs.
Access the application as a user or test user with appropriate permissions and attempt to execute application features and functions that provide direct access to the system.
Review the logs and ensure the actions executed were logged.
Log information must include the user responsible for executing the action, the action executed, and the result of the action.
If the application does not log all direct access to the system, this is a finding.
V-222466
False
APSC-DV-000870
Review the application documentation and interview the application administrator.
Identify if the application implements a direct access feature or function that allows users to directly access the underlying OS.
Direct access includes but is not limited to: executing OS commands, navigating the file system, manipulating system resources such as print queues, or reading files hosted on the OS that are not specifically shared or made available on the website.
If the application does not provide direct access to the system, this requirement is not applicable.
Access the application logs.
Access the application as a user or test user with appropriate permissions and attempt to execute application features and functions that provide direct access to the system.
Review the logs and ensure the actions executed were logged.
Log information must include the user responsible for executing the action, the action executed, and the result of the action.
If the application does not log all direct access to the system, this is a finding.
M
4093