STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

Unnecessary built-in application accounts must be disabled.

DISA Rule

SV-222661r508029_rule

Vulnerability Number

V-222661

Group Title

SRG-APP-000516

Rule Version

APSC-DV-003270

Severity

CAT II

CCI(s)

• CCI-003109 - The organization requires the developer of the information system, system component, or information system service to deliver the system, component, or service with organization-defined security configurations implemented.
• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Disable unnecessary built-in userids, use other strong authentication when possible and use strong passwords if accounts are necessary for application operation.

Check Contents

Review the application documentation and identify if the application creates or utilizes built-in accounts.

Examine the account list for obvious examples (e.g., accounts with vendor names such as Oracle or Tivoli).

Verify that these accounts have been removed or disabled.

If enabled built-in accounts are present, ask the application representative the reason for their existence.

If the account is required in order for the application to operate properly, verify the account password has been changed to a DoD acceptable value.

If these accounts are not necessary to run the application, or if the accounts are required and the password has not been changed to meet DoD password requirements, this is a finding.

Vulnerability Number

V-222661

Documentable

False

Rule Version

APSC-DV-003270

Severity Override Guidance

Review the application documentation and identify if the application creates or utilizes built-in accounts.

Examine the account list for obvious examples (e.g., accounts with vendor names such as Oracle or Tivoli).

Verify that these accounts have been removed or disabled.

If enabled built-in accounts are present, ask the application representative the reason for their existence.

If the account is required in order for the application to operate properly, verify the account password has been changed to a DoD acceptable value.

If these accounts are not necessary to run the application, or if the accounts are required and the password has not been changed to meet DoD password requirements, this is a finding.

Check Content Reference

M

Target Key

4093

Comments