STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

Applications used for non-local maintenance sessions must audit non-local maintenance and diagnostic sessions for organization-defined auditable events.

DISA Rule

SV-222561r508029_rule

Vulnerability Number

V-222561

Group Title

SRG-APP-000409

Rule Version

APSC-DV-001930

Severity

CAT II

CCI(s)

• CCI-002884 - The organization audits nonlocal maintenance and diagnostic sessions^ organization-defined audit events.

Weight

10

Fix Recommendation

Configure the application to log when application maintenance functionality is executed remotely.

Check Contents

Review the application documentation and interview the application administrator to identify application maintenance functions.

If the application does not provide non-local maintenance and diagnostic capability, this requirement is not applicable.

Identify the maintenance functions/capabilities that are provided by the application and performed by an individual which can be performed remotely.

For example, the application may provide the ability to clean up a folder of temporary files, add users, remove users, restart processes, backup certain files, manage logs, or execute diagnostic sessions.

Identify and open the audit logs that capture maintenance actions performed by the application.

Accessing the application in the appropriate role to execute maintenance tasks, perform several maintenance tasks and observe the logs.

If the application provides maintenance functions and capabilities and those functions are not logged when they are executed, this is a finding.

Vulnerability Number

V-222561

Documentable

False

Rule Version

APSC-DV-001930

Severity Override Guidance

Review the application documentation and interview the application administrator to identify application maintenance functions.

If the application does not provide non-local maintenance and diagnostic capability, this requirement is not applicable.

Identify the maintenance functions/capabilities that are provided by the application and performed by an individual which can be performed remotely.

For example, the application may provide the ability to clean up a folder of temporary files, add users, remove users, restart processes, backup certain files, manage logs, or execute diagnostic sessions.

Identify and open the audit logs that capture maintenance actions performed by the application.

Accessing the application in the appropriate role to execute maintenance tasks, perform several maintenance tasks and observe the logs.

If the application provides maintenance functions and capabilities and those functions are not logged when they are executed, this is a finding.

Check Content Reference

M

Target Key

4093

Comments