STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must employ a deny-all, permit-by-exception (whitelist) policy to allow the execution of authorized software programs.

DISA Rule

SV-222517r508029_rule

Vulnerability Number

V-222517

Group Title

SRG-APP-000386

Rule Version

APSC-DV-001490

Severity

CAT II

CCI(s)

• CCI-001774 - The organization employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information system.

Weight

10

Fix Recommendation

Configure the application to utilize a deny-all, permit-by-exception policy when allowing the execution of authorized software.

Check Contents

If the application is not a configuration management or similar type of application designed to manage system processes and configurations, this requirement is not applicable.

Review the application documentation and interview the application administrator to identify if application whitelisting specifying which applications or application subcomponents are allowed to execute is in use.

Check for the existence of policy settings or policy files that can be configured to restrict application execution. Have the application administrator demonstrate how the program execution is restricted. Look for a deny-all, permit-by-exception policy of restriction.

Some methods for restricting execution include but are not limited to the use of custom capabilities built into the application or leveraging of Windows Group Policy, AppLocker, Software Restriction Policies, Java Security Manager or Role-Based Access Controls (RBAC).

If application whitelisting is not utilized or does not follow a deny-all, permit-by-exception (whitelist) policy, this is a finding.

Vulnerability Number

V-222517

Documentable

False

Rule Version

APSC-DV-001490

Severity Override Guidance

If the application is not a configuration management or similar type of application designed to manage system processes and configurations, this requirement is not applicable.

Review the application documentation and interview the application administrator to identify if application whitelisting specifying which applications or application subcomponents are allowed to execute is in use.

Check for the existence of policy settings or policy files that can be configured to restrict application execution. Have the application administrator demonstrate how the program execution is restricted. Look for a deny-all, permit-by-exception policy of restriction.

Some methods for restricting execution include but are not limited to the use of custom capabilities built into the application or leveraging of Windows Group Policy, AppLocker, Software Restriction Policies, Java Security Manager or Role-Based Access Controls (RBAC).

If application whitelisting is not utilized or does not follow a deny-all, permit-by-exception (whitelist) policy, this is a finding.

Check Content Reference

M

Target Key

4093

Comments