STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must ensure users are authenticated with an individual authenticator prior to using a group authenticator.

DISA Rule

SV-222529r508029_rule

Vulnerability Number

V-222529

Group Title

SRG-APP-000153

Rule Version

APSC-DV-001610

Severity

CAT II

CCI(s)

• CCI-000770 - The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.

Weight

10

Fix Recommendation

Design and configure the application to individually authenticate group account members prior to allowing access.

Check Contents

Review the application documentation, examine user accounts, group membership and interview the application administrator to identify group or shared accounts. Document the group or shared account information.

If the application does not use group or shared accounts, this requirement is not applicable.

Create a test account or use an existing group member account.

Ensure the test account is not authenticated to the application and attempt to access the application with the group account credentials.

If the application allows access without first requiring the group member to authenticate with their individual credentials, this is a finding.

Vulnerability Number

V-222529

Documentable

False

Rule Version

APSC-DV-001610

Severity Override Guidance

Review the application documentation, examine user accounts, group membership and interview the application administrator to identify group or shared accounts. Document the group or shared account information.

If the application does not use group or shared accounts, this requirement is not applicable.

Create a test account or use an existing group member account.

Ensure the test account is not authenticated to the application and attempt to access the application with the group account credentials.

If the application allows access without first requiring the group member to authenticate with their individual credentials, this is a finding.

Check Content Reference

M

Target Key

4093

Comments