STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

DISA Rule

SV-222522r508029_rule

Vulnerability Number

V-222522

Group Title

SRG-APP-000148

Rule Version

APSC-DV-001540

Severity

CAT I

CCI(s)

• CCI-000764 - The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

Weight

10

Fix Recommendation

Configure the application to uniquely identify and authenticate users and user processes.

Check Contents

Review the application documentation and interview the application administrator to determine how organizational users access the application.

If the application is publicly available, providing access to publicly releasable data and the users are non-organizational users such as individuals who no longer have a CAC (e.g., retirees) or members of the public with no requirement for DoD credentials, this requirement is not applicable.

The requirement still applies to DoD organizational users and admins when accessing the non-public data areas or system resources of the system.

Attempt to access the application and confirm that a unique user account and password or CAC token and pin are required in order to access the application.

If the application does not uniquely identify and authenticate users, this is a finding.

Vulnerability Number

V-222522

Documentable

False

Rule Version

APSC-DV-001540

Severity Override Guidance

Review the application documentation and interview the application administrator to determine how organizational users access the application.

If the application is publicly available, providing access to publicly releasable data and the users are non-organizational users such as individuals who no longer have a CAC (e.g., retirees) or members of the public with no requirement for DoD credentials, this requirement is not applicable.

The requirement still applies to DoD organizational users and admins when accessing the non-public data areas or system resources of the system.

Attempt to access the application and confirm that a unique user account and password or CAC token and pin are required in order to access the application.

If the application does not uniquely identify and authenticate users, this is a finding.

Check Content Reference

M

Target Key

4093

Comments