What changed in Application Server Security Requirements Guide V4R6V4R6 changes

Discussion

Application management includes the ability to control the number of sessions that utilize an application by all accounts and/or account types. Limiting the number of allowed sessions is helpful in limiting risks related to Denial of Service attacks. Application servers host and expose business logic and application processes. The application server must possess the capability to limit the maximum number of concurrent sessions in a manner that affects the entire application server or on an individual application basis. Although there is some latitude concerning the settings themselves, the settings should follow DoDDoW-recommended values, but the settings should be configurable to allow for future DoDDoW direction. While the DoDDoW will specify recommended values, the values can be adjusted to accommodate the operational requirement of a given system.

V-204708 in V4R6

Discussion

Log generation and log records can be generated from various components within the application server. The list of logged events is the set of events for which logs are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating log records (e.g., logable events, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked). The events occurring must be time-correlated in order to conduct accurate forensic analysis. In addition, the correlation must meet certain tolerance criteria. For instance, DoDDoW may define that the time stamps of different logged events must not differ by any amount greater than ten seconds. It is also acceptable for the application server to utilize an external logging tool that provides this capability.

V-204716 in V4R6

Discussion

Changes to any software components can have significant effects on the overall security of the application. Verifying software components have been digitally signed using a certificate recognized and approved by the organization ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, patches, service packs, or application components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The application should not have to verify the software again. This requirement does not mandate DODDoW certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.

V-204740 in V4R6

Discussion

Application servers provide a myriad of differing processes, features and functionalities. Some of these processes may be deemed to be unnecessary or too unsecure to run on a production DoDDoW system. Application servers must provide the capability to disable or deactivate functionality and services that are deemed to be non-essential to the server mission or can adversely impact server performance, for example, disabling dynamic JSP reloading on production application servers as a best practice.

V-204743 in V4R6

Discussion

Some networking protocols may not meet organizational security requirements to protect data and components. Application servers natively host a number of various features, such as management interfaces, httpd servers and message queues. These features all run on TCPIP ports. This creates the potential that the vendor may choose to utilize port numbers or network services that have been deemed unusable by the organization. The application server must have the capability to both reconfigure and disable the assigned ports without adversely impacting application server operation capabilities. For a list of approved ports and protocols, reference the DoDDoW ports and protocols web site at https://public.cyber.mil/connect/ppsm/

V-204744 in V4R6

Title

The application server must use an approved DODDoW enterprise identity, credential, and access management (ICAM) solution to uniquely identify and authenticate users (or processes acting on behalf of organizational users).

Discussion

To ensure accountability and prevent unauthorized access, application server users must be uniquely identified and authenticated. This is typically accomplished via the use of a user store, which is either local (OS-based) or centralized (LDAP). However, DoDI 8520.03 now requires that applications use an approved DODDoW enterprise (E-ICAM) solution whenever the ICAM solution addresses information system needs. Where the ICAM solution has been evaluated and found to not meet the needs of information system owners, information system owners must reevaluate decisions to use locally managed solutions and transition to DODDoW enterprise ICAM solutions to the maximum extent possible as the enterprise ICAM solutions mature.

V-204745 in V4R6

Check text

Review application server documentation to ensure the application server provides a PKI integration capability that meets DoDDoW PKI infrastructure requirements. If the application server is not configured to meet this requirement, this is a finding.

Fix text

Configure the application server to utilize the DoDW Enterprise PKI infrastructure.

Discussion

The cornerstone of PKI is the private key used to encrypt or digitally sign information. The key by itself is a cryptographic value that does not contain specific user information, but the key can be mapped to a user. Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis. Application servers must provide the capability to utilize and meet requirements of the DoDDoW Enterprise PKI infrastructure for application authentication.

V-204756 in V4R6

Discussion

Encryption is only as good as the encryption modules utilized. Unapproved cryptographic module algorithms cannot be verified and cannot be relied upon to provide confidentiality or integrity, and DoDDoW data may be compromised due to weak algorithms. The use of TLS provides confidentiality of data in transit between the application server and client. TLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems.

V-204758 in V4R6

Discussion

When data is written to digital media such as hard drives, mobile computers, external/removable hard drives, personal digital assistants, flash/thumb drives, etc., there is risk of data loss and data compromise. Fewer protection measures are needed for media containing information determined by the organization to be in the public domain, to be publicly releasable, or to have limited or no adverse impact if accessed by other than authorized personnel. In these situations, it is assumed the physical access controls where the media resides provide adequate protection. As part of a defense-in-depth strategy, data owners and DoDthe DoW should consider routinely encrypting information at rest on selected secondary storage devices. The employment of cryptography is at the discretion of the information owner/steward. The selection of the cryptographic mechanisms used is based upon maintaining the confidentiality and integrity of the information. The strength of mechanisms is commensurate with the classification and sensitivity of the information. The application server must directly provide, or provide access to, cryptographic libraries and functionality that allow applications to encrypt data when it is stored.

V-204770 in V4R6

Discussion

Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When applications provide the capability to change security roles or escalate the functional capability of the application, it is critical the user reauthenticate. In addition to the reauthentication requirements associated with session locks, the application server security model may require reauthentication of individuals in other situations, including (but not limited to) the following circumstances: (i) When authenticators change; (ii) When roles change; (iii) When security categories of information systems change; (iv) When the execution of privileged functions occurs; (v) After a fixed period of time; or (vi) Periodically. Within the DODDoW, the minimum circumstances requiring reauthentication are privilege escalation and role changes.

V-204798 in V4R6

Discussion

The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. PIV credentials are only used in an unclassified environment. DoDDoW has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as its use as a primary component of layered protection for national security systems. The application server must support the use of PIV credentials to access the management interface and perform management functions.

V-204800 in V4R6

Discussion

The use of Personal Identity Verification (PIV) credentials facilitates standardization and reduces the risk of unauthorized access. PIV credentials are only used in an unclassified environment. DoDDoW has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as its use as a primary component of layered protection for national security systems. The application server must electronically verify the use of PIV credentials to access the management interface and perform management functions.

V-204801 in V4R6

Check text

The CAC is the standard DoDDoW authentication token; the PIV is the standard authentication token used by federal/civilian agencies. If access to the application server is limited to DoDDoW personnel accessing the system via CAC; and PIV access is not warranted or allowed as per the system security plan, the PIV requirement is NA. Review the application server documentation and configuration to determine if the application server electronically verifies PIV credentials from other federal agencies to access the management interface. If the application server does not electronically verify other federal agency PIV credentials to access the management interface, this is a finding.

Discussion

Personal Identity Verification (PIV) credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidance documents. OMB Memorandum 11-11 requires federal agencies to continue implementing the requirements specified in HSPD-12 to enable agency-wide use of PIV credentials. PIV credentials are only used in an unclassified environment. If PIV credentials are not electronically verified before accessing the management interface, unauthorized users may gain access to the system and data the user has not been granted access to.

V-204807 in V4R6

Title

The application server must only allow the use of DoDW PKI-established certificate authorities for verification of the establishment of protected sessions.

Check text

Review the application server documentation and configuration to determine if the application server only allows the use of DoDDoW PKI-established certificate authorities. If the application server allows other certificate authorities for verification, this is a finding.

Fix text

Configure the application server to allow the use of DoDW PKI-established certificate authorities for verification of the establishment of protected sessions.

Discussion

Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoDDoW systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoDDoW-approved CA, trust of this CA has not been established. The DoDDoW will only accept PKI certificates obtained from a DoDDoW-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of SSL/TLS certificates. The application server must only allow the use of DoDDoW PKI-established certificate authorities for verification.

V-204811 in V4R6

Title

The application server must use DOD-oW or CNSS-approved PKI Class 3 or Class 4 certificates.

Check text

Review the application server configuration to determine if the application server utilizes approved PKI Class 3 or Class 4 certificates. If the application server is not configured to use approved DODDoW or CNS certificates, this is a finding.

Fix text

Configure the application server to use DOD-oW or CNSS-approved Class 3 or Class 4 PKI certificates.

Discussion

Class 3 PKI certificates are used for servers and software signing rather than for identifying individuals. Class 4 certificates are used for business-to-business transactions. Utilizing unapproved certificates not issued or approved by DODDoW or CNS creates an integrity risk. The application server must utilize approved DODDoW or CNS Class 3 or Class 4 certificates for software signing and business-to-business transactions. This requirement also applies to Zero Trust initiatives.

V-204832 in V4R6

Severity

mediumhigh

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Protecting log data is important during a forensic investigation to ensure investigators can track and understand what may have occurred. Off-loading should be set up as a scheduled task but can be configured to be run manually, if other processes during the off-loading are manual. Off-loading is a common process in information systems with limited log storage capacity.

V-204833 in V4R6

Title

The application server must be configured in accordance with the security configuration settings based on DoDDoW security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.

Check text

Review the application server documentation and configuration to determine if the application server is configured in accordance with the security configuration settings based on DoDDoW security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs. If the application server is not configured in accordance with security configuration settings, this is a finding.

Fix text

Configure the application server to be in accordance with the security configuration settings based on DoDDoW security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.

Discussion

Configuring the application to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoDDoW that reflects the most restrictive security posture consistent with operational requirements. Configuration settings are the set of parameters that can be changed that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the application, including the parameters required to satisfy other security control requirements.

V-204834 in V4R6