V3R1 changes
ISEC7 Sphere STIG V3R1 (2024-10-24) replaced V2R1 (2020-10-23): 1 check removed, 34 updated. It has 34 checks, against 35 in V2R1.
V3R1 checklistV2R1 checklist Compare V2R1 and V3R1 in STIG Compare
- 0 added
- 1 removed
- 34 updated
Updated fields: Check text 34Fix text 34Title 25Discussion 24CCIs 3
Removed since V2R1 (1)
- V-224787CAT IIThe version number of Apache Tomcat must be removed from the CATALINA_HOME/lib/catalina.jar file.
Updated in V3R1 (34)
V-224760CAT IIThe ISEC7 SPHERE must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.Title, Check text, Fix text, Discussion
Title
The ISEC7 SPHEMMRE Suite must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.
Check text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Verify the maxConnections setting is set according to organizational guidelines.
Verify the maxThreads setting is set according to organizational guidelines.
If the maxConnections setting is not set according to organizational guidelines or the maxThreads setting is not set according to organizational guidelines, this is a finding.
Fix text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Set the maxConnections setting according to organizational guidelines.
Set the maxThreads setting according to organizational guidelines.
Restart the ISEC7 EMMSPHERE Suite Web service.
Discussion
Application management includes the ability to control the number of users and user sessions that utilize an application. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to denial-of-service (DoS) attacks. This requirement may be met via the application or by utilizing information system session control provided by a web server with specialized session management capabilities. If it has been specified that this requirement will be handled by the application, the capability to limit the maximum number of concurrent single user sessions must be designed and built into the application. This requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system.
V-224761CAT IIThe ISEC7 SPHERE must initiate a session lock after a 15-minute period of inactivity.Title, Check text, Fix text
Title
The ISEC7 SPHEMMRE Suite must initiate a session lock after a 15-minute period of inactivity.
Check text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Validate the session timeout has been set to the correct value.
Alternatively, allow the console to sit for 15 minutes and confirm thatthe youuser areis prompted to login once again when attempting to navigate to a new screen.
If the EMMSPHERE Console timeout has not been set for 15 minutes or less, this is a finding.
Fix text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Set the session timeout to the correct value of 15 minutes or less.
V-224762CAT IIThe ISEC7 SPHERE must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.Title, Check text, Fix text, Discussion
Title
The ISEC7 SPHEMMRE Suite must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.
Check text
LoginLog in to the EMMISEC7 SPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Verify sslProtocol"protocols" is set to +TLSv1.2, +TLSv1.3.
If the"protocols" sslProtocol is not set to +TLSv1.2 or higher, this is a finding.
Fix text
LoginLog in to the EMMISEC7 SPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Using the dropdown menu for sslProtocolprotocols, select +TLSv1.2, +TLSv1.3.
Click "Update".
Restart the ISEC7 EMMSPHERE Suite Web service.
Discussion
Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.
This requirement applies to Transport Layer Security (TLS) gateways (also known as Secure Sockets Layer [SSL] gateways), web servers, and web applications and is not applicable to virtual private network (VPN) devices. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance for client negotiation on either DoDDOD-only or on public-facing servers.
V-224763CAT IIThe ISEC7 SPHERE must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the ISEC7 SPHERE.Title, Check text, Fix text, Discussion
Title
The ISEC7 SPHEMMRE Suite must display the Standard Mandatory DoOD Notice and Consent Banner before granting access to the ISEC7 EMM SuitePHERE.
Check text
Log in to the ISEC7 EMMSPHERE Console.
Note if the appropriate Standard mandatory DoDDOD Notice and Consent Banner is displayed.
Alternatively, if already logged intoin to the ISEC7 EMMSPHERE Console, navigate to Administration >> User Self Service >> Page Customizations.
Verify that a Page Customization exists to display the Standard mandatory DoDDOD Notice and Consent Banner.
If a Page Customization does not exist, or it does not contain the required DoDDOD banner, this is a finding.
Fix text
LoginSet to the ISEC7session EMMtimeout Suite console.
Navigate to Administration >> User Self Service >> Page Customizations.
Enter a name for the bannercorrect pagevalue customizationof and15 selectminutes Add.
Inor the new window, select Edit for the English Disclaimer and paste the DoD Standard Disclaimer Warning textless.
Select Confirm.
Discussion
Display of the DoDDOD-approved use notification before granting access to the application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.
The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for applications that can accommodate banners of 1300 characters:
"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
By using this IS (which includes any device attached to this IS), you consent to the following conditions:
-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
-At any time, the USG may inspect and seize data stored on this IS.
-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.
-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:
"I've read & consent to terms in IS user agreem't."
V-224764CAT IIThe ISEC7 SPHERE server must be configured to have at least one user in the following Administrator roles: Security Administrator, Site Administrator, and Help Desk User.Title, Check text, Fix text
Title
The ISEC7 EMMSPHERE Suite server must be configured to have at least one user in the following Administrator roles: Security Administrator, Site Administrator, and Help Desk User.
Check text
LoginLog in to the ISEC7 EMMSPHERE Suite console.
Navigate to Administration >> Configuration >> GlobalAccess Permissions.
Verify for each Role (Security Administrator, Site Administrator, and Help Desk User) that at least one user or AD group has been assigned.
If for each Role (Security Administrator, Site Administrator, Help Desk User) there is not at least one user (or AD group) assigned, this is a finding.
Fix text
LoginLog in to the ISEC7 EMMSPHERE Suite console.
Navigate to Administration >> Configuration >> GlobalAccess Permissions.
Assign at least one user or AD group to each of the following roles,: Security Administrator, Site Administrator, and Help Desk User.
V-224765CAT IIThe ISEC7 SPHERE must alert the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure.Title, Check text, Fix text
Title
The ISEC7 EMMSPHERE Suite must alert the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure.
Check text
LoginLog in to the ISEC7 EMMSPHERE Suite console.
Navigate to Administration >> Configuration >> Notifications >> Recipient Lists.
Select "Edit" next to the Systems Notifications.
Verify the email address or distribution list has been added.
If a recipient email address or distribution list has not been added to System Notifications, this is a finding.
Fix text
LoginLog in to the ISEC7 EMMSPHERE Suite console.
Navigate to Administration >> Configuration >> Notifications >> Recipient Lists.
Select "Edit" next to the Systems Notifications.
Under Add recipient, select "Email" as the Type and enter the correct email address of recipients.
Select "Add".
V-224766CAT IIThe ISEC7 SPHERE must back up audit records at least every seven days onto a different system or system component than the system or component being audited, provide centralized management and configuration of the content to be captured in audit records generated by all ISEC7 SPHERE components, and offload audit records onto a different system or media than the system being audited.Title, Check text, Fix text, CCIs
Title
The ISEC7 EMMSPHERE Suite must back up audit records at least every seven days onto a different system or system component than the system or component being audited, provide centralized management and configuration of the content to be captured in audit records generated by all ISEC7 EMMSPHERE Suite components, and off-loadoffload audit records onto a different system or media than the system being audited.
Check text
Open the central log repository and verify the ISEC7 logs have been written to the location of the log server.
Alternatively:
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Verify that the log directory path is set to the desired location.
Alternatively:
On the ISEC7 EMMSPHERE Suite server, browse to the install directory.
Default is %Install Drive%/Program Files/ISEC7 EMM SuiteSPHERE.
Select the conf folder.
Open config.properties and verify the logPath is set to the desired location.
If ISEC7 EMMSPHERE logs are not written to an audit log management server, this is a finding.
Fix text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Set the log directory path to the desired location.
Alternatively:
On the ISEC7 EMMSPHERE Suite server, browse to the install directory.
Default is %Install Drive%/Program Files/ISEC7 EMM SuiteSPHERE.
Select the conf folder.
Open config.properties and set the logPath to the desired location of the log server.
CCIs
CCI-001348,CCI-001844,CCI-001851
V-224767CAT IISEC7 SPHERE must disable or delete local account created during application installation and configuration.Title, Check text, Fix text, Discussion
Title
ISEC7 SPHEMMRE Suite must disable or delete local account created during application installation and configuration.
Check text
Log in to the ISEC7 EMMSPHERE Suite console.
Navigate to Administration >> Configuration >> Account Management >> Users.
Select "Edit" next to the local account Admin.
Verify Login"Log in disabled" has been selected.
If Login"Log in disabled" has not been selected, this is a finding.
Fix text
Log in to the ISEC7 EMMSPHERE Suite console.
Navigate to Administration >> Configuration >> Account Management >> Users.
Select "Edit" next to the local account Admin.
Check Login"Log in disabled" for the account.
Click "Save".
Discussion
The ISEC7 local account password complexity controls do not meet DoDDOD requirements; therefore, admins have the capability to configure the account out of compliance, which could allow attacker to gain unauthorized access to the server and access to command MDM servers.
V-224768CAT IIWhen using PKI-based authentication for user access, the ISEC7 SPHERE must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.Title, Check text, Fix text, Discussion
Title
When using PKI-based authentication for user access, the ISEC7 EMMSPHERE Suite must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
Check text
LoginLog in to the server(s) hosting the ISEC7 EMMSPHERE Suite application.
Open the Microsoft Management Console and add the Local Computer Certificates snap-in.
Open the Trusted Root Certification Authorities >> Certificates.
Verify the DoDDOD Root PKI Certificates Authorities have been added to the server.
If the DoDDOD Root PKI Certificates Authorities have not been added to the server, this is a finding.
Fix text
LoginLog in to the server(s) hosting the ISEC7 EMMSPHERE Suite application.
Open the Microsoft Management Console and add the Local Computer Certificates snap-in.
Open the Trusted Root Certification Authorities >> Certificates.
Install the DoDDOD Root PKI Certificates Authorities to the server.
Discussion
Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. To meet this requirement, the information system must create trusted channels between itself and remote trusted authorized IT product (e.g., syslog server) entities that protect the confidentiality and integrity of communications. The information system must create trusted paths between itself and remote administrators and users that protect the confidentiality and integrity of communications.
A trust anchor is an authoritative entity represented via a public key and associated data. It is most often used in the context of public key infrastructures, X.509 digital certificates, and DNSSEC. However, applications that do not use a trusted path are not approved for non-localnonlocal and remote management of DoDDOD information systems.
Use of SSHv2 to establish a trusted channel is approved. Use of FTP, TELNET, HTTP, and SNMPV1 is not approved since they violate the trusted channel rule set. Use of web management tools that are not validated by common criteria my also violate trusted channel rule set.
When there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA.
This requirement verifies that a certification path to an accepted trust anchor is used for certificate validation and that the path includes status information. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Validation of the certificate status information is out of scope for this requirement.
V-224769CAT IIIThe ISEC7 SPHERE must accept Personal Identity Verification (PIV) credentials.Title, Check text, Fix text, Discussion
Title
The ISEC7 SPHEMMRE Suite must accept Personal Identity Verification (PIV) credentials.
Check text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Settings.
Verify the CAC login box has been checked.
On the ISEC7 EMMSPHERE Suite server, browse to the install directory.
Default is %Install Drive%/Program Files/ISEC7 EMM SuiteSPHERE
Select the conf folder.
Open config.properties and confirm the following lines exist:
cacUserUIDRegex=^CN=[^0-9]*11.([0-9]+),
cacUserUIDProperty=UserPrincipalName
Browse to %Install Drive%/Program Files >> ISEC7 EMMSPHERE Suite >> Tomcat >> conf
Confirm the server.xml file has clientAuth="required" under the Connection.
If the required commendscommands do not exist in config.properties or if clientAuth does not ="required" in the server.xml file, this is a finding.
Fix text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> SettingsLDAP.
Check the"Also CACenable loginuser boxcertificate logins.
On thee.g. ISEC7from EMMsmart Suitecards server,(CAC)".
Check browse"Only toallow thecertificates installwith directory.
Defaultextended iskey %Installusage Drive%/Programfor Files/ISEC7smartcard EMMlogon Suite(1.
Select the conf folder3.
Open config6.properties and add the following lines:
cacUserUIDRegex=^CN=[^0-9]*111.([0-9]+4.1.311.20.2.2),".
cacUserUIDProperty=UserPrincipalName
Browse to %Install Drive%/Program Files >> ISEC7 EMMSPHERE Suite >> Tomcat >> conf.
Open the server.xml file and add clientAuth="required" under the Connection.
Discussion
The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access.
DoDDOD has mandated the use of the CAC to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems.
V-224770CAT IIBefore establishing a local, remote, and/or network connection with any endpoint device, the ISEC7 SPHERE must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the device.Title, Check text, Fix text, Discussion
Title
Before establishing a local, remote, and/or network connection with any endpoint device, the ISEC7 EMMSPHERE Suite must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the device.
Check text
Log in to the ISEC7 EMMSPHERE Console.
Confirm that the browser session is secured using a DoDDOD issued certificate.
Internet Explorer:
Click on the Padlock icon at the end of the url field.
Select "View Certificates".
Confirm that the Issued By is a valid DoDDOD Certificate Authority.
Google Chrome:
Click on the Padlock icon at the front of the url field.
Select "Certificate".
Confirm that the Issued By is a valid DoDDOD Certificate Authority.
Alternately, Loglog in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Identify which type of Keystore is being used.
Windows MY:
Open the Microsoft Management Console.
Add the Certificates Snap-In for the ISEC7 Service Account.
Navigate to the Personal Certificates Store.
Verify the certificate is issued by a DoDDOD Trusted Certificate Authority.
JavaKeystore PKCS12:
Using a Keystore browser such as Portecle, open the ISEC7 EMMSPHERE Suite keystore.
Enter the Keystore password when prompted.
Open the installed certificate and verify it was issued by a DoDDOD Trusted Certificate Authority.
If certificates used by the server are not DoD DOD-issued certificates, this is a finding.
Fix text
Submit a CSR for a DoDDOD-issued Issuedcertificate Certificate with the private key.
Retrieve the approved certificate from the issuing Certificate Authority.
Set the friendly name on the certificate to https.
Windows-MY:
Open the Microsoft Management Console.
Add the Certificates Snap-In for the ISEC7 Service Account.
Navigate to the Personal Certificates Store.
Import the certificate with Private key.
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Set the Keystore Type to Windows-MY.
Restart the ISEC7 SPHERE Web service.
JavaKeystore:
Using a Keystore browser such as Portecle, open the ISEC7 EMMSPHERE Suite keystore.
Enter the Keystore password when prompted.
Delete the self-signed certificate in the keystore.
Import the DoD DOD-issued certificate with the private key.
Enter the key password when prompted.
Enter the certificate alias as "https" when prompted.
Save the keystore with the same keystore password.
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Verify the Keystore type is set to JavaKeystore PKCS12.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Using the dropdown menu for "sslProtocol", select TLSv1.2.
Select Update at the bottom of the page.
Restart the ISEC7 EMMSPHERE Suite Web service.
Discussion
Without device-to-device authentication, communications with malicious devices may be established. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk. Currently, DoDDOD requires the use of AES for bidirectional authentication since it is the only FIPS-validated AES cipher block algorithm.
For distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions.
A local connection is any connection with a device communicating without the use of a network. A network connection is any connection with a device that communicates through a network (e.g., local area or wide area network; the Internetinternet). A remote connection is any connection with a device communicating through an external network (e.g., the Internetinternet).
Because of the challenges of applying this requirement on a large scale, organizations are encouraged to apply the requirement only to those limited number (and type) of devices that truly need to support this capability.
V-224771CAT IIThe ISEC7 SPHERE must allow the use of DOD PKI established certificate authorities for verification of the establishment of protected sessions.Title, Check text, Fix text, Discussion
Title
The ISEC7 SPHEMMRE Suite must allow the use of DoOD PKI established certificate authorities for verification of the establishment of protected sessions.
Check text
Log in to the ISEC7 EMMSPHERE ConsoleServer.
ConfirmNavigate thatto the%Install browserDrive%/Program sessionFiles/ISEC7 is secured using a DoD issued certificateSPHERE/tomcat/bin.
InternetRun Explorer:
Click on the Padlock icon at the end of the url fieldtomcat9w.
Selectbat Viewand Certificates.
Confirmselect that the IssuedJAVA Bytab isin a valid DoD Certificate Authority.
Google Chrome:
Click on the Padlockwindow icon at the front of the url field.
Select Certificate.
Confirm that the Issued By is a valid DoD Certificate Authorityopens.
Alternately,Under Log"Java inoptions" toverify the ISEC7 EMM Console"-Djavax.
Navigate to Administration >> Configuration >> Apache Tomcat Settingsnet.
Identify which type of Keystore is being usedssl.
trustStoreType=Windows MY:
Open the Microsoft Management Console.
Add the Certificates Snap-InROOT" for the ISEC7 Service Account.
Navigate to the Personal Certificates Store.
Verify the certificate is issued by a DoD Trusted Certificate Authoritylisted.
JavaKeystoreIf PKCS12:
Using a Keystore browser such as Portecle, open the ISEC7 EMM Suite keystore"-Djavax.
Enter the Keystore password when promptednet.
Open the installed certificate and verify it was issued by a DoD Trusted Certificate Authorityssl.
IftrustStoreType=Windows-ROOT" certificatesis used by the server are not DoD issued certificateslisted, this is a finding.
Fix text
Submit a CSR for a DoD Issued Certificate with the private key.
Retrieve the approved certificate from the issuing Certificate Authority.
Set the friendly name on the certificate to https.
Windows-MY:
Open the Microsoft Management Console.
Add the Certificates Snap-In for the ISEC7 Service Account.
Navigate to the Personal Certificates Store.
Import the certificate with Private key.
Log in to the ISEC7 EMMSPHERE ConsoleServer.
Navigate to Administration%Install >>Drive%/Program ConfigurationFiles/ISEC7 >> Apache Tomcat SettingsSPHERE/tomcat/bin.
SetRun the Keystore Type to Windows-MYtomcat9w.
JavaKeystore:
Usingbat aand Keystoreselect browser such as Portecle, open the ISEC7JAVA EMMtab Suitein keystore.
Enter the Keystorewindow passwordthat when promptedopens.
DeleteUnder the"Java self-signedoptions" certificateadd in the keystore"-Djavax.
Import the DoD issued certificate with the private keynet.
Enter the key password when promptedssl.
EntertrustStoreType=Windows-ROOT" theand certificateselect alias as https when prompted"OK".
SaveRestart the keystore with the same keystore password.
Log in to the ISEC7 EMMSPHERE Console.
NavigateWeb to Administration >> Configuration >> Apache Tomcat Settingsservice.
Verify the Keystore type is set to JavaKeystore PKCS12.
Discussion
Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoDDOD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoDDOD-approved CA, trust of this CA has not been established.
The DoDDOD will only accept PKI certificates obtained from a DoDDOD-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of TLS certificates.
This requirement focuses on communications protection for the application session rather than for the network packet.
This requirement applies to applications that utilize communications sessions. This includes, but is not limited to, web-based applications and Service-Oriented Architectures (SOA).
V-224772CAT IIThe ISEC7 SPHERE must protect the confidentiality and integrity of transmitted information during preparation for transmission and during reception using cryptographic mechanisms.Title, Check text, Fix text, Discussion
Title
The ISEC7 EMMSPHERE Suite must protect the confidentiality and integrity of transmitted information during preparation for transmission and during reception using cryptographic mechanisms.
Check text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Verify thatprotocols sslProtocol is set to TLS1+TLSv1.2, +TLSv1.3.
If theprotocols sslProtocol is not set to TLS1+TLSv1.2 or higher, this is a finding.
Fix text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
VerifyUsing thatthe sslProtocoldrop-down ismenu setfor toprotocols, TLS1select +TLSv1.2, +TLSv1.3.
Click "Update".
Restart the ISEC7 SPHERE Web service.
Discussion
Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered.
This requirement applies only to those applications that are either distributed or can allow access to data non-locallynonlocally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, applications need to leverage transmission protection mechanisms, such as TLS, TLS VPNs, or IPSEC.
Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.
Satisfies: SRG-APP-000439, SRG-APP-000440, SRG-APP-000441, SRG-APP-000442
V-224773CAT IIThe ISEC7 SPHERE must be configured to leverage the enterprise directory service accounts and groups for ISEC7 SPHERE server admin identification and authentication.Title, Check text, Fix text
Title
The ISEC7 EMMSPHERE Suite must be configured to leverage the enterprise directory service accounts and groups for ISEC7 EMMSPHERE Suite server admin identification and authentication.
Check text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> LDAP.
Verify that a LDAP entry has been configured to the enterprise.
Select "Edit" and confirm the "Use for Login" check box has been selected.
Navigate to Administration >> Configuration >> Settings.
Verify that Log in using (Default) has been set to the enterprise connection.
If a LDAP entry has not been configured to the enterprise or Log in using (Default) has not been set to the enterprise connection, this is a finding.
Fix text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> LDAP.
Select "Add new LDAP ".
Provide the connection information for the enterprise LDAP connection.
Check the box "Use for Login".
Navigate to Administration >> Configuration >> Settings.
Set Log in using (Default) to the enterprise connection.
V-224774CAT IIThe ISEC7 SPHERE must configure the timeout for the console to be 15 minutes or less.Title, Check text, Fix text
Title
The ISEC7 SPHEMMRE Suite must configure the timeout for the console to be 15 minutes or less.
Check text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Validate the session timeout has been set to the correct value.
Alternatively, allow the console to sit for 15 minutes and confirm that youthe areuser is prompted to loginlog in once again when attempting to navigate to a new screen.
If the EMMSPHERE Console timeout has not been set for 15 minutes or less, this is a finding.
Fix text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Set the session timeout to the correct value of 15 minutes or less.
V-224775CAT IIThe ISEC7 SPHERE, Tomcat installation, and ISEC7 Suite monitor must be configured to use the Windows Trust Store for the storage of digital certificates and keys.Title, Check text, Fix text
Title
The ISEC7 EMM SuiteSPHERE, Tomcat installation, and ISEC7 Suite monitor must be configured to use the Windows Trust Store for the storage of digital certificates and keys.
Check text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Verify that the type of Keystore being used is: Windows-MY
If the type of Keystore being used is not Windows-MY, this is a finding.
Fix text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Select the type of Keystore to be used as:
Windows-MY
Restart the ISEC7 SPHERE Web service.
V-224776CAT IIIf cipher suites using pre-shared keys are used for device authentication, the ISEC7 SPHERE must have a minimum security strength of 112 bits or higher, must only be used in networks where both the client and server are government systems, must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0 and must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithm for transmission.Title, Check text, Fix text, Discussion
Title
If cipher suites using pre-shared keys are used for device authentication, the ISEC7 EMMSPHERE Suite must have a minimum security strength of 112 bits or higher, must only be used in networks where both the client and server are Governmentgovernment systems, must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0 and must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithm for transmission.
Check text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Verify thatprotocols sslProtocol is set to TLS1+TLSv1.2, +TLSv1.3.
If theprotocols sslProtocol is not set to TLS1+TLSv1.2 or higher, this is a finding.
Fix text
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
VerifyUsing thatthe sslProtocoldropdown ismenu setfor toprotocols, TLS1select +TLSv1.2, +TLSv1.3.
Click "Update".
Restart the ISEC7 SPHERE Web service.
Discussion
Pre-shared keys are symmetric keys that are already in place prior to the initiation of a Transport Layer Security (TLS) session (e.g., as the result of a manual distribution). In general, pre-shared keys should not be used. However, the use of pre-shared keys may be appropriate for some closed environments that have stung key management best practices.
Pre-shared keys may be appropriate for constrained environments with limited processing, memory, or power. If pre-shared keys are appropriate and supported, the following additional guidelines must be followed. Consult 800-52 for recommended pre-shared key cipher suites for pre-shared keys. Pre-shared keys must be distributed in a secure manner, such as a secure manual distribution or using a key establishment certificate. These cipher suites employ a pre-shared key for device authentication (for both the server and the client) and may also use RSA or ephemeral Diffie-Hellman (DHE) algorithms for key establishment.
Because these cipher suites require pre-shared keys, these suites are not generally applicable to classic secure website applications and are not expected to be widely supported in TLS clients or TLS servers. NIST suggests that these suites be considered in particular for infrastructure applications, particularly if frequent authentication of the network entities is required. These cipher suites may be used with TLS versions 1.1 or 1.2. Note that cipher suites using GCM, SHA-256, or SHA-384 are only available in TLS 1.2.
Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol.
This requirement applies to Transport Layer Security (TLS) gateways (also known as Secure Sockets Layer [SSL] gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance for client negotiation, either on DoDDOD-only or on public-facing servers.
If unsecured protocols (lacking cryptographic mechanisms) are used for sessions, the contents of those sessions will be susceptible to manipulation, potentially allowing alteration and hijacking of maintenance sessions.
Satisfies: SRG-APP-000585, SRG-APP-000590, SRG-APP-000560, SRG-APP-000645
V-224777CAT IIThe ISEC7 SPHERE must use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (nonlegacy use).Title, Check text, Fix text
Title
The ISEC7 SPHEMMRE Suite must use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (non-legacy use).
Check text
Log in to the ISEC7 EMMSPHERE Console.
Confirm that the browser session is secured using a DoDDOD issued certificate.
Alternately, Loglog in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Identify which type of Keystore is being used.
Windows MY:
Open the Microsoft Management Console.
Add the Certificates Snap-In for the ISEC7 Service Account.
Navigate to the Personal Certificates Store.
Verify the certificate is issued by a DoDDOD Trusted Certificate Authority.
JavaKeystore PKCS12:
Using a Keystore browser such as Portecle, open the ISEC7 EMMSPHERE Suite keystore.
Enter the Keystore password when prompted.
Open the installed certificate and verify it was issued by a DoDDOD Trusted Certificate Authority.
If certificates used by the server are not DoDDOD issued certificates, this is a finding.
Fix text
Submit a CSR for a DoDDOD Issued Certificate with the private key.
Retrieve the approved certificate from the issuing Certificate Authority.
Set the friendly name on the certificate to https.
Windows-MY:
Open the Microsoft Management Console.
Add the Certificates Snap-In for the ISEC7 Service Account.
Navigate to the Personal Certificates Store.
Import the certificate with Private key.
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Set the Keystore Type to Windows-MY.
Restart the ISEC7 SPHERE Web service.
JavaKeystore:
Using a Keystore browser such as Portecle, open the ISEC7 EMMSPHERE Suite keystore.
Enter the Keystore password when prompted.
Delete the self-signed certificate in the keystore.
Import the DoDDOD issued certificate with the private key.
Enter the key password when prompted.
Enter the certificate alias as https when prompted.
Save the keystore with the same keystore password.
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Verify the Keystore type is set to JavaKeystore PKCS12.
Restart the ISEC7 SPHERE Web service.
V-224778CAT IIThe ISEC7 SPHERE must use a FIPS-validated cryptographic module to provision digital signatures.Title, Check text, Fix text, Discussion
Title
The ISEC7 SPHEMMRE Suite must use a FIPS-validated cryptographic module to provision digital signatures.
Check text
Log in to the ISEC7 EMMSPHERE Console.
Confirm that the browser session is secured using a DoDDOD issued certificate.
Alternately, Loglog in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Identify which type of Keystore is being used.
Windows MY:
Open the Microsoft Management Console.
Add the Certificates Snap-In for the ISEC7 Service Account.
Navigate to the Personal Certificates Store.
Verify the certificate is issued by a DoDDOD Trusted Certificate Authority.
JavaKeystore PKCS12:
Using a Keystore browser such as Portecle, open the ISEC7 EMMSPHERE Suite keystore.
Enter the Keystore password when prompted.
Open the installed certificate and verify it was issued by a DoDDOD Trusted Certificate Authority.
If certificates used by the server are not DoDDOD issued certificates, this is a finding.
Fix text
Submit a CSR for a DoDDOD Issued Certificate with the private key.
Retrieve the approved certificate from the issuing Certificate Authority.
Set the friendly name on the certificate to https.
Windows-MY:
Open the Microsoft Management Console.
Add the Certificates Snap-In for the ISEC7 Service Account.
Navigate to the Personal Certificates Store.
Import the certificate with Private key.
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Set the Keystore Type to Windows-MY.
Restart the ISEC7 SPHERE Web service.
JavaKeystore:
Using a Keystore browser such as Portecle, open the ISEC7 EMMSPHERE Suite keystore.
Enter the Keystore password when prompted.
Delete the self-signed certificate in the keystore.
Import the DoD DOD-issued certificate with the private key.
Enter the key password when prompted.
Enter the certificate alias as https when prompted.
Save the keystore with the same keystore password.
Log in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Verify the Keystore type is set to JavaKeystore PKCS12.
Restart the ISEC7 SPHERE Web service.
Discussion
Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.
The cryptographic module used must have one FIPS-validated encryption algorithm (i.e., validated Advanced Encryption Standard [AES]). This validated algorithm must be used for encryption for cryptographic security function within the product being evaluated.
EMMSPHERE Suite is using the standard JCE module coming with OpenJDK 1117 (included in installer) or Oracle JRE either legacy 1.8 or latest release (see https://openjdk.java.net/groups/security/). There are two module providers, IBM and RSA. The check/fix are written assuming the RSA module is used. Any FIPS 140-2 compliant JCE module (.jar) can be replaced and configured and used with EMM SuiteSPHERE.
Satisfies: SRG-APP-000630, SRG-APP-000412, SRG-APP-000514
V-224779CAT IIThe ISEC7 SPHERE must use a FIPS 140-2-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality, generate cryptographic hashes, and to configure web management tools with FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions.Title, Check text, Fix text, Discussion
Title
The ISEC7 EMMSPHERE Suite must use a FIPS 140-2-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality, generate cryptographic hashes, and to configure web management tools with FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions.
Check text
Log in to the ISEC7 EMMSPHERE Console.
Confirm that the browser session is secured using a DoDDOD issued certificate.
Alternately, Loglog in to the ISEC7 EMMSPHERE Console.
Navigate to Administration >> Configuration >> Apache Tomcat Settings.
Identify which type of Keystore is being used.
Windows MY:
Open the Microsoft Management Console.
Add the Certificates Snap-In for the ISEC7 Service Account.
Navigate to the Personal Certificates Store.
Verify the certificate is issued by a DoDDOD Trusted Certificate Authority.
JavaKeystore PKCS12:
Using a Keystore browser such as Portecle, open the ISEC7 EMMSPHERE Suite keystore.
Enter the Keystore password when prompted.
Open the installed certificate and verify it was issued by a DoDDOD Trusted Certificate Authority.
If certificates used by the server are not DoDDOD issued certificates, this is a finding.
Fix text
LoginSubmit toa theCSR ISEC7for EMMa SuiteDOD MonitorIssued serverCertificate with the private key.
BrowseRetrieve tothe approved certificate from the Javaissuing Install1Lib1SecurityCertificate Authority.
EditSet the Javafriendly name on the certificate to https.Security
Windows-MY:
Open filethe Microsoft Management Console.
Add the followingCertificates entriesSnap-In infor boldthe ISEC7 Service Account.
Navigate to the JavaPersonal Certificates Store.Security
Import file:the certificate with Private key.
Log in to the ISEC7 SPHERE Console.
securityNavigate to Administration >> Configuration >> Apache Tomcat Settings.provider.1=com.rsa.jsafe.provider.JsafeJCE
securitySet the Keystore Type to Windows-MY.provider.2=sun.security.provider.Sun
securityRestart the ISEC7 SPHERE Web service.provider.3=sun.security.rsa.SunRsaSign
security
JavaKeystore:
Using a Keystore browser such as Portecle, open the ISEC7 SPHERE keystore.provider.4=sun.security.ec.SunEC
securityEnter the Keystore password when prompted.provider.5=com.sun.net.ssl.internal.ssl.Provider
Delete JsafeJCEthe self-signed certificate in the keystore.
securityImport the DOD issued certificate with the private key.provider.6=com.sun.crypto.provider.SunJCE
securityEnter the key password when prompted.provider.7=sun.security.jgss.SunProvider
securityEnter the certificate alias as https when prompted.provider.8=com.sun.security.sasl.Provider
securitySave the keystore with the same keystore password.provider.9=org.jcp.xml.dsig.internal.dom.XMLDSigRI
securityLog in to the ISEC7 SPHERE Console.provider.10=sun.security.smartcardio.SunPCSC
securityNavigate to Administration >> Configuration >> Apache Tomcat Settings.provider.11=sun.security.mscapi.SunMSCAPI
comVerify the Keystore type is set to JavaKeystore PKCS12.rsa.cryptoj.jce.kat.strategy=on.load
comRestart the ISEC7 SPHERE Web service.rsa.cryptoj.jce.fips140initialmode=FIPS140_SSL
Discussion
FIPS 140-2 precludes the use of invalidated cryptography for the cryptographic protection of sensitive or valuable data within Federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard.
The cryptographic module used must have one FIPS-validated encryption algorithm (i.e., validated Advanced Encryption Standard [AES]). This validated algorithm must be used for encryption for cryptographic security function within the product being evaluated.
EMMSPHERE Suite is using the standard JCE module coming with OpenJDK 1117 (included in installer) or Oracle JRE either legacy 1.8 or latest release.
see https://openjdk.java.net/groups/security/ There are two module providers, IBM and RSA. The check/fix are written assuming the RSA module is used.
Any FIPS 140-2 compliant JCE module (.jar) can be replaced and configured and used with EMM SuiteSPHERE.
V-224780CAT IIThe Apache Tomcat Manager Web app password must be cryptographically hashed with a DOD-approved algorithm.Title, Check text, Fix text, Discussion, CCIs
Title
The Apache Tomcat Manager Web app password must be cryptographically hashed with a DoOD -approved algorithm.
Check text
Verify the Apache Tomcat Manager Web app password is hashed using SHA-256 (or SHA-512).
LoginLog in to the ISEC7 EMMSPHERE Suite server.
Navigate to <Drive>:1Program Files1ISEC7 EMM Suite1Tomcat1conf1SPHERE1Tomcat1conf1
Open tomcat-users.xml and verify the user password has been hashed with an obfuscated password.
ex: <user password="310c55aa3d5b42217e7f0e80ce30467d$100000$529cceb1fbc80f4f461fc1bd56219d79d9c94d4a8fc46abad0646f27e753ff9e" roles="manager-gui,manager-script" username="admin"/>
Open <Drive>:1Program Files1ISEC7 EMM Suite1Tomcat1conf1serverSPHERE1Tomcat1conf1server.xml with Notepad.exe.
Select Edit >> Find and search for CredentialHandler.
Confirm the text: <CredentialHandler algorithm="PBKDF2WithHmacSHA512" keyLength="256" />
Close the file.
If the Apache Tomcat Manager Web app password is not hashed using SHA-256 (or SHA-512), this is a finding.
Fix text
To encrypt the Tomcat Manager Web app password, run the ISEC7 integrated installer or use the following manual procedure.
Note: The ISEC7 integrated installer will configure SHA-512 as the hash algorithm, which is not available with the manual procedure. The manual procedure will configure SHA-256. Both are DoDDOD approved.
LoginLog in to the ISEC7 EMMSPHERE Suite server.
Browse to <Drive>:1Program Files1ISEC7 EMMSPHERE1Tomcat1conf Suite1Tomcat1conf and open Tomcat-Users.xml
Open the Command Prompt and CD to <Drive>:1Program Files1ISEC7 EMM Suite1Tomcat1binSPHERE1Tomcat1bin
Execute the following command:
digest -a SHA-256 -h org.apache.catalina.realm.MessageDigestCredentialHandler *
*where Where password is the 15 character password designated for the account.
Copy the output, which is the SHA-256 hashed digest password.
In Tomcat-Users.xml, add in the password for the user with the obfuscated output.
ex: <user password="310c55aa3d5b42217e7f0e80ce30467d$100000$529cceb1fbc80f4f461fc1bd56219d79d9c94d4a8fc46abad0646f27e753ff9e" roles="manager-gui,manager-script" username="admin"/>
Save the file.
Open <Drive>:1Program Files1ISEC7 EMM Suite1Tomcat1conf1serverSPHERE1Tomcat1conf1server.xml with Notepad.exe.
Select Edit >> Find and search for CredentialHandler.
Replace the text with: <CredentialHandler className="org.apache.catalina.realm.MessageDigestCredentialHandler" algorithm="SHA-256" />
Save the file.
Restart the ISEC7 EMMSPHERE Suite Web service using the services.msc
Discussion
The Apache Tomcat Manager Web app password is stored in plain text in CATALINA_HOME/conf/tomcat-users.xml and should be encrypted so it is not visible to an intruder.
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read and easily compromised. Use of passwords for authentication is intended only for limited situations and should not be used as a replacement for two-factor CAC-enabled authentication.
Examples of situations where a user ID and password might be used include:
- When the user does not use a CAC and is not a current DoDDOD employee, member of the military, or DoDDOD contractor.
- When a user has been officially designated as temporarily unable to present a CAC for some reason (lost, damaged, not yet issued, broken card reader) (i.e., Temporary Exception User) and to satisfy urgent organizational needs must be temporarily permitted to use user ID/password authentication until the problem with CAC use has been remedied.
- When the application is publicly available and or hosting publicly releasable data requiring some degree of need-to-know protection.
If the password is already encrypted and not a plaintext password, this meets this requirement. Implementation of this requirement requires configuration of FIPS-approved cipher block algorithm and block cipher modes for encryption. This method uses a one-way hashing encryption algorithm with a salt value to validate a user's password without having to store the actual password. Performance and time required to access are factors that must be considered, and the one-way hash is the most feasible means of securing the password and providing an acceptable measure of password security.
Verifying the user knows a password is performed using a password verifier. In its simplest form, a password verifier is a computational function that is capable of creating a hash of a password and determining if the value provided by the user matches the hash. A more secure version of verifying a user knowing a password is to store the result of an iterating hash function and a large random salt value as follows:
H0 = H(pwd, H(salt))
Hn = H(Hn-1,H(salt))
In the above, "n" is a cryptographically-strong random [*3] number. "Hn" is stored along with the salt. When the application wishes to verify that the user knows a password, it simply repeats the process and compares "Hn" with the stored "Hn". A salt is essentially a fixed-length cryptographically strong random value.
Another method is using a keyed-hash message authentication code (HMAC). HMAC calculates a message authentication code via a cryptographic hash function used in conjunction with an encryption key. The key must be protected as with any private key.
This requirement applies to all accounts including authentication server, AAA, and local account, including the root account and the account of last resort.
CCIs
CCI-00401962
V-224781CAT IIAll Web applications included with Apache Tomcat that are not required must be removed.Check text, Fix text, Discussion
Check text
Verify CATALINA_HOME/webapps Tomcat administrative tool has been configured to remove all Web applications that are not required.
Log in to the ISEC7 EMMSPHERE Suite server.
Browse to <Drive>:1Program Files1ISEC7 EMM Suite1Tomcat1webapps1SPHERE1Tomcat1webapps1
Confirm all folders in the directory with the exception of Manager and Host-Manager have been removed.
If the CATALINA_HOME/webapps Tomcat administrative tool has not been configured to remove all Web applications that are not required, this is a finding.
Fix text
To configure the CATALINA_HOME/webapps Tomcat administrative tool to remove all Web applications that are not required, run the ISEC7 integrated installer or use the following manual procedure:
LoginLog in to the ISEC7 EMMSPHERE Suite server.
Browse to <Drive>:1Program Files1ISEC7 EMM Suite1Tomcat1webapps1SPHERE1Tomcat1webapps1
Remove all folders in the directory with the exception of Manager and Host-Manager.
Discussion
Removal of unneeded or non-securenonsecure functions, ports, protocols, and services mitigate the risk of unauthorized connection of devices, unauthorized transfer of information, or other exploitation of these resources.
The organization must perform a periodic scan/review of the application (as required by CCI-000384) and disable functions, ports, protocols, and services deemed to be unneeded or non-securenonsecure.
V-224782CAT IILockOutRealm must not be removed from Apache Tomcat.Check text, Fix text, Discussion
Check text
Log in to the ISEC7 EMMSPHERE Suite server.
Navigate to <Drive>:1Program Files1Isec7 EMM Suite1Tomcat1ConfigSPHERE1Tomcat1Config
Open the server.xml file with Notepad.
Select Edit >> Find and search for LockOutRealm.
Confirm the following line is in the server.xml file:
<Realm className="org.apache.catalina.realm.LockOutRealm">
If it is not found or has been commented out, this is a finding.
If the LockOutRealm has been removed and can'tcannot be used, this is a finding.
Fix text
LoginLog in to the ISEC7 EMMSPHERE Suite server.
Navigate to <Drive>:1Program Files1Isec7 EMM Suite1Tomcat1ConfigSPHERE1Tomcat1Config
Open the server.xml file with Notepad.
Select Edit >> Find and search for LockOutRealm.
Add the following line is in the server.xml file:
<Realm className="org.apache.catalina.realm.LockOutRealm">
Restart the ISEC7 EMMSPHERE Suite Web service in the services.msc.
Discussion
LockOutRealm prevents brute force attacks against user passwords. Removal of unneeded or non-securenonsecure functions, ports, protocols, and services mitigate the risk of unauthorized connection of devices, unauthorized transfer of information, or other exploitation of these resources.
The organization must perform a periodic scan/review of the application (as required by CCI-000384) and disable functions, ports, protocols, and services deemed to be unneeded or non-securenonsecure.
V-224783CAT IIThe LockOutRealm must be configured with a login failure count of 3.Check text, Fix text, Discussion
Check text
Verify the failureCount parameter is set to 3 in the LockOutRealm configuration.
LoginLog in to the ISEC7 EMMSPHERE Suite server.
Navigate to <Drive>:1Program Files1Isec7 EMM Suite1Tomcat1ConfigSPHERE1Tomcat1Config.
Open the server.xml file with Notepad.
Select Edit >> Find and search for LockOutRealm.
Verify the failureCount parameter is set to 3 in the following file:
<Realm className="org.apache.catalina.realm.LockOutRealm" failureCount="3" lockOutTime="900" >
If the failureCount parameter is not set to 3 in the LockOutRealm configuration, this is a finding.
Fix text
Add failureCount parameter to the LockOutRealm configuration:
LoginLog in to the ISEC7 EMMSPHERE Suite server.
Navigate to <Drive>:1Program Files1Isec7 EMM Suite1Tomcat1ConfigSPHERE1Tomcat1Config.
Open the server.xml file with Notepad.
Select Edit >> Find and search for LockOutRealm.
Add the following line is in the server.xml file:
<Realm className="org.apache.catalina.realm.LockOutRealm" failureCount="3" lockOutTime="900" >
Restart the ISEC7 EMMSPHERE Suite Web service in the services.msc.
Discussion
LockOutRealm prevents brute force attacks against user passwords. Removal of unneeded or non-securenonsecure functions, ports, protocols, and services mitigate the risk of unauthorized connection of devices, unauthorized transfer of information, or other exploitation of these resources. Access to LockOutRealm must be configured to control login attempts by local accounts.
The organization must perform a periodic scan/review of the application (as required by CCI-000384) and disable functions, ports, protocols, and services deemed to be unneeded or non-securenonsecure.
V-224784CAT IIThe LockOutRealm must be configured with a login lockout time of 15 minutes.Check text, Fix text, Discussion
Check text
Verify the lockOutTime parameter is set to 900 in the LockOutRealm configuration.
LoginLog in to the ISEC7 EMMSPHERE Suite server.
Navigate to <Drive>:1Program Files1Isec7 EMM Suite1Tomcat1ConfigSPHERE1Tomcat1Config.
Open the server.xml file with Notepad.
Select Edit >> Find and search for LockOutRealm.
Verify the lockOutTime parameter is set to 900 in the following file:
<Realm className="org.apache.catalina.realm.LockOutRealm" failureCount="3" lockOutTime="900" >
If the lockOutTime parameter is not set to 900 in the LockOutRealm configuration, this is a finding.
Fix text
Add lockOutTime parameter to the LockOutRealm configuration:
LoginLog in to the ISEC7 EMMSPHERE Suite server.
Navigate to <Drive>:1Program Files1Isec7 EMM Suite1Tomcat1ConfigSPHERE1Tomcat1Config.
Open the server.xml file with Notepad.
Select Edit>Find and search for LockOutRealm.
Add the following line is in the server.xml file:
<Realm className="org.apache.catalina.realm.LockOutRealm" failureCount="3" lockOutTime="900" >
Restart the ISEC7 EMMSPHERE Suite Web service in the services.msc.
Discussion
LockOutRealm prevents brute force attacks against user passwords. Removal of unneeded or non-securenonsecure functions, ports, protocols, and services mitigate the risk of unauthorized connection of devices, unauthorized transfer of information, or other exploitation of these resources. Access to LockOutRealm must be configured to control login attempts by local accounts.
The organization must perform a periodic scan/review of the application (as required by CCI-000384) and disable functions, ports, protocols, and services deemed to be unneeded or non-securenonsecure.
V-224785CAT IIThe Manager Web app password must be configured as follows: -15 or more characters. -at least one lower case letter. -at least one upper case letter. -at least one number. -at least one special character.Title, Check text, Fix text, CCIs
Title
The Manager Web app password must be configured as follows:
-15 or more characters .
-at least one lower case letter.
-at least one upper case letter.
-at least one number .
-at least one special character.
Check text
Verify the Manager Web app password has been configured as follows:
-15 or more characters.
-at least one lower case letter.
-at least one upper case letter.
-at least one number.
-at least one special character.
LoginLog in to the ISEC7 EMMSPHERE Suite server.
Open a Web browser and go to https://localhost/manager/html.
LoginLog in with the custom administrator login and password. Verify password entered meets complexity requirements.
If the Manager Web app password has not been configured as required, this is a finding.
Fix text
To set a strong password on the Manager Web app, run the ISEC7 integrated installer or use the following manual procedure:
LoginLog in to the ISEC7 EMMSPHERE Suite server.
Browse to <Drive>:1Program Files1ISEC7 EMMSPHERE1Tomcat1conf Suite1Tomcat1conf and open Tomcat-Users.xml.
Open the Command Prompt and CD to <Drive>:1Program Files1ISEC7 EMM Suite1Tomcat1binSPHERE1Tomcat1bin.
Execute the following using 'sha' command:
digest –a sha password*
*whereWhere password is the 15 character password designated for the account.
Copy the output, which is the hashed digest password.
In Tomcat-Users.xml, add in the password for the user with the obfuscated output at <user password="**", where ** is the obfuscated password.
example: <user password="310c55aa3d5b42217e7f0e80ce30467d$100000$529cceb1fbc80f4f461fc1bd56219d79d9c94d4a8fc46abad0646f27e753ff9e" roles="manager-gui,manager-script" username="admin"/>
Save the file.
Open <Drive>:1Program Files1ISEC7 EMM Suite1Tomcat1conf1serverSPHERE1Tomcat1conf1server.xml with Notepad.exe.
Enter: <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase" digest="sha"/>
Save the file.
Restart the ISEC7 EMMSPHERE Suite Web service using the services.msc.
Note: the password must meet the following complexity requirements:
-15 or more characters.
-at least one lower case letter.
-at least one upper case letter.
-at least one number.
-at least one special character.
CCIs
CCI-000205,CCI-000192,CCI-001619CCI-004066
V-224786CAT IIThe ISEC7 SPHERE must configure Enable HTTPS to use HTTP over SSL in Apache Tomcat.Title, Check text, Fix text, Discussion
Title
The ISEC7 SPHEMMRE Suite must configure Enable HTTPS to use HTTP over SSL in Apache Tomcat.
Check text
Verify Enable HTTPS has been configured to use HTTP over SSL:
Open a web browser that is able to reach the ISEC7 EMMSPHERE Suite console.
Verify that the address used has a prefix of "https://".
Alternately:
Log in to the ISEC7 EMMSPHERE Suite server.
Open the server.xml file located at <Drive>:1Program Files1ISEC7 EMMSPHERE1Tomcat1conf Suite1Tomcat1conf with Notepad.exe.
Select Edit >> Find and search for Connector port="443" .
Confirm the connector is present and not commented out:
<Connector port="443" useServerCipherSuitesOrder="true" sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation" secure="true" scheme="https" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="200" keystoreType="Windows-MY" keystoreFile="" keyAlias="https" clientAuth="none" ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,TLS_ECDH_ECDSA_WITH_RC4_128_SHA,TLS_ECDH_RSA_WITH_RC4_128_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,TLS_EMPTY_RENEGOTIATION_INFO_SCSVF" SSLEnabled="true"/>
If Enable HTTPS has not been configured to use HTTP over SSL, this is a finding.
Fix text
To enable HTTPS to use HTTP over SSL, run the ISEC7 integrated installer or use the following manual procedure:
Log in to the ISEC7 EMMSPHERE Suite server.
Open the server.xml file located at <Drive>:1Program Files1ISEC7 EMMSPHERE1Tomcat1conf Suite1Tomcat1conf with Notepad.exe.
Select Edit >> Find and search for Connector port="443" .
If the connector is not present add:
ex: <Connector portSSLEnabled="443true" useServerCipherSuitesOrdermaxParameterCount="true1000" sslImplementationNamemaxThreads="200" port="443" protocol="org.apache.tomcatcoyote.utilhttp11.net.jsse.JSSEImplementationHttp11NioProtocol" securescheme="truehttps" schemesecure="httpstrue" protocolsslImplementationName="org.apache.coyotetomcat.http11util.Http11NioProtocolnet.jsse.JSSEImplementation">
<SSLHostConfig maxThreadscertificateVerification="200false" keystoreTypeciphers="WindowsHIGH:!aNULL:!MD5:!3DES:!ARIA:!SHA:!CAMELLIA:!AES128-MYCCM8:!AES128-CCM:!AES256-CCM8:!AES256-CCM:!DHE" keystoreFilehonorCipherOrder="true" keyAliasprotocols="https+TLSv1.2,+TLSv1.3">
<Certificate clientAuthcertificateKeyAlias="nonehttps" cipherscertificateKeystoreFile="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,TLS_ECDH_ECDSA_WITH_RC4_128_SHA,TLS_ECDH_RSA_WITH_RC4_128_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,TLS_EMPTY_RENEGOTIATION_INFO_SCSVF" SSLEnabledcertificateKeystoreType="trueWindows-MY"/>
</SSLHostConfig>
</Connector>
Modifying the certificateKeystoreFile path and certificateKeystorePassword as needed or leveraging the Windows-MY certificateKeystoreType instead.
If the connector has been commented out, remove the comment characters.
Save the file.
Restart the ISEC7EMMISEC7 SuiteSPHERE Web service in the services.msc
Discussion
Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered.
This requirement applies only to those applications that are either distributed or can allow access to data non-locallynonlocally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, applications need to leverage transmission protection mechanisms, such as TLS, TLS VPNs, or IPSEC.
Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.
V-224788CAT IIStack tracing must be disabled in Apache Tomcat.Check text, Fix text, Discussion
Check text
Verify stack tracing has been disabled in Apache Tomcat.
Navigate to the ISEC7 EMMSPHERE Suite installation directory: <Drive>:1Program Files1ISEC7 EMM Suite1web1WEBSPHERE1web1WEB-INF.
Open web.xml with Notepad.exe.
Scroll to the end of the file.
Confirm there are no comment tags <!--" and "--> and the following exists without comment tags:
<error-page>
<exception-type>java.lang.Exception</exception-type>
<location>/exception.jsp</location>
</error-page>
If stack tracing has not been disabled in Apache Tomcat, this is a finding.
Fix text
Remove the default error page by updating the web application web.xml file.
Navigate to the ISEC7 EMMSPHERE Suite installation directory: <Drive>:1Program Files1ISEC7 EMM Suite1web1WEBSPHERE1web1WEB-INF.
Open web.xml with Notepad.exe.
Scroll to the end of the file.
Remove the comment tags <!--" and "-->.
<!-- <error-page>
<exception-type>java.lang.Exception</exception-type>
<location>/exception.jsp</location>
</error-page> -->
Save the changes.
This will acknowledge to the user that an exception occurred without showing any trace or source information.
Discussion
The default error page shows a full stack trace, which is a disclosure of sensitive information. Removal of unneeded or non-securenonsecure functions, ports, protocols, and services mitigate the risk of unauthorized connection of devices, unauthorized transfer of information, or other exploitation of these resources.
The organization must perform a periodic scan/review of the application (as required by CCI-000384) and disable functions, ports, protocols, and services deemed to be unneeded or non-securenonsecure.
V-224789CAT IIThe Apache Tomcat shutdown port must be disabled.Check text, Fix text, Discussion
Check text
Verify the shutdown port is disabled.
Log in to the EMMSPHERE Suite server.
Browse to Program Files1Isec7 EMM Suite1Tomcat1ConfSPHERE1Tomcat1Conf.
Open the server.xml with Notepad.exe.
Select Edit >> Find, and then search for "Shutdown".
Verify that the shutdown port has been disabled with below entry below:
shutdown="-1"
If the shutdown port has not been disabled, this is a finding.
Fix text
Log in to the EMMSPHERE Suite server.
Browse to Program Files1Isec7 EMM Suite1Tomcat1ConfSPHERE1Tomcat1Conf.
Open the server.xml with Notepad.exe.
Select Edit >> Find, and then search for "Shutdown".
Change the shutdown to "-1".
example: shutdown=-1
Save the file and restart the Isec7 EMMSPHERE Suite Web service with the services.msc.
Discussion
Tomcat uses a port (defaults to 8005) as a shutdown port. Someone could Telnet to the machine using this port and send the default command SHUTDOWN. Tomcat and all web apps would shut down in that case, which is a denial -of -service attack and would cause an unwanted service interruption.
V-224790CAT IIThe ISEC7 SPHERE must remove any unnecessary users or groups that have permissions to the server.xml file in Apache Tomcat.Title, Check text, Fix text, Discussion
Title
The ISEC7 SPHEMMRE Suite must remove any unnecessary users or groups that have permissions to the server.xml file in Apache Tomcat.
Check text
Verify unnecessaryusersunnecessary users or groups that have permissions to the Server.xml file in Apache Tomcat have been removed.
Browse to ProgramFiles1Isec7 EMMSPHERE1Tomcat1Conf Suite1Tomcat1Conf and select "Server.xml".
Right -click and select "Properties".
Select the security tab and verify no unnecessaryaccountunnecessary account or groups have been granted permissions to the file.
Verify no unnecessaryusersunnecessary users or groups have permissions to the file.
If unnecessaryusersunnecessary users or groups that have permissions to the Server.xml file in Apache Tomcat have not been removed, this is a finding.
Fix text
Log in to the ISEC7 EMMSPHERE Suite server.
Browse to ProgramFiles1Isec7 EMMSPHERE1Tomcat1Conf Suite1Tomcat1Conf and select Server.xml.
Right -click and select "Properties".
Select the security tab and remove unnecessaryaccountsunnecessary accounts or groups that have been granted permissions to the Server.xml file.
Discussion
Tomcat uses a port (defaults to 8005) as a shutdown port. Someone could Telnet to the machine using this port and send the default command SHUTDOWN. Tomcat and all web apps would shut down in that case, which is a denial -of -service attack and would cause an unwanted service interruption.
V-224791CAT IIA manager role must be assigned to the Apache Tomcat Web apps (Manager, Host-Manager).Check text, Fix text
Check text
Verify a manager role has been assigned to the Apache Tomcat Web apps (Manager, Host-Manager).
LoginLog in to the ISEC7 EMMSPHERE Suite server.
Navigate to <Drive>:1Program Files1ISEC7 EMM Suite1Tomcat1conf1SPHERE1Tomcat1conf1.
Confirm a user with the manager role to <Drive>:1Program Files1ISEC7 EMM Suite1Tomcat1conf1tomcatSPHERE1Tomcat1conf1tomcat-users.xml exists.
example: <user username="admin" roles="manager-gui,manager-script" ..../>
If a manager role has not been assigned to the Apache Tomcat Web apps, this is a finding.
Fix text
To add a manager role to the Apache Tomcat Web apps (Manager, Host-Manager), run the ISEC7 integrated installer or use the following manual procedure:
By default there are no users with the manager role assigned. To make use of the manager webapp, you need to add a new role and user into the <Drive>:1Program Files1ISEC7 EMM Suite1Tomcat1conf1tomcatSPHERE1Tomcat1conf1tomcat-users.xml file.
LoginLog in to the ISEC7 EMMSPHERE Suite server.
Navigate to <Drive>:1Program Files1ISEC7 EMM Suite1Tomcat1conf1SPHERE1Tomcat1conf1.
Add a user with the manager role to <Drive>:1Program Files1ISEC7 EMM Suite1Tomcat1conf1tomcatSPHERE1Tomcat1conf1tomcat-users.xml.
example: <user username="admin" roles="manager-gui,manager-script" ..../>
Save the file.
V-224792CAT IISSL must be enabled on Apache Tomcat.Check text, Fix text, Discussion
Check text
VerifyTo configure SSL issupport enabled on Apache Tomcat.
Verify, Enablerun HTTPS has been configured to use HTTP over SSL:
Open a web browser that is able to reach the ISEC7 EMMintegrated Suiteinstaller console.
Verifyor thatuse the addressfollowing usedmanual has a prefix of httpsprocedure://
Alternately:
LoginLog in to the ISEC7 EMMSPHERE Suite server.
Open the server.xml file located at <Drive>:1Program Files1ISEC7 EMMSPHERE1Tomcat1conf Suite1Tomcat1conf with Notepad.exe.
Select Edit >> Find and search for Connector port="443" .
ConfirmIf the connector is not present andadd:
ex: not<Connector commentedSSLEnabled="true" outmaxParameterCount="1000" maxThreads="200" port="443" protocol="org.apache.coyote.http11.Http11NioProtocol" scheme="https" secure="true" sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation">
<SSLHostConfig certificateVerification="false" ciphers="HIGH:!aNULL:!MD5:!3DES:!ARIA:!SHA:!CAMELLIA:!AES128-CCM8:!AES128-CCM:!AES256-CCM8:!AES256-CCM:!DHE" honorCipherOrder="true" protocols="+TLSv1.2,+TLSv1.3">
If<Certificate SSLcertificateKeyAlias="https" iscertificateKeystoreFile="" notcertificateKeystoreType="Windows-MY"/>
</SSLHostConfig>
</Connector>
Modifying enabledthe oncertificateKeystoreFile Apachepath Tomcatand certificateKeystorePassword as needed or leveraging the Windows-MY certificateKeystoreType instead.
If the connector has been commented out, thisremove isthe acomment findingcharacters.
Save the file.
Restart the ISEC7 SPHERE Web service.
Fix text
To configure SSL support on Tomcat, run the ISEC7 integrated installer or use the following manual procedure:
ToLog configurein SSL support on Tomcat, you need to change the connectorISEC7 typeSPHERE in <Drive>:1Program Files1ISEC7 EMM Suite1Tomcat1conf1serverserver.xml
Open
Log in to the ISEC7 EMM Suite server.
Browsexml tofile located at <Drive>:1Program Files1ISEC7 EMMSPHERE1Tomcat1conf Suite1Tomcat1conf1
Edit the server.xml with Notepad.exe.
Select Edit >> Find and search for connector port="443".
ReplaceIf the existingconnector connectionis withnot thepresent connection below, modifying the keystoreFile path and password as needed.add:
ex: <Connector portSSLEnabled="443true" useServerCipherSuitesOrdermaxParameterCount="true1000" securemaxThreads="true200" schemeport="https443" protocol="comorg.isec7apache.bnatorcoyote.utilshttp11.common.Http11NioProtocol" maxThreadsscheme="200" keystoreType="PKCS12" keystorePass="" keystoreFile="C:1Program Files1ISEC7 EMM Suite_nmci1conf1https.pfx" keyAlias="https" clientAuthsecure="none" ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,TLS_ECDH_ECDSA_WITH_RC4_128_SHA,TLS_ECDH_RSA_WITH_RC4_128_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,TLS_EMPTY_RENEGOTIATION_INFO_SCSVF" SSLEnabled="true"/>
Remark: The user should not uncomment the connector tag for port 80/8080. It is recommended to keep this for the automated ISEC7 EMM Suite Agent update from the ISEC7 EMM Suite Tomcat portal (see 2.2.3). If you decline port 80/8080, the user has to enable J2SE SSL as described in section 2.2.1 with the same keystore file for very ISEC7 EMM Suite Agent host.
Then the user can click on OK and restart the Apache Tomcat service to put the new configuration into effect.
One can find further information at https://tomcat.apache.org/tomcat-8.5-doc/ssl-howto.html
Alternatively, you can use the Windows certificate store instead of a local keystore file.
<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol" sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation">
<SSLHostConfig securecertificateVerification="truefalse" schemeciphers="httpsHIGH:!aNULL:!MD5:!3DES:!ARIA:!SHA:!CAMELLIA:!AES128-CCM8:!AES128-CCM:!AES256-CCM8:!AES256-CCM:!DHE" maxThreads="200" SSLEnabled="true"><SSLHostConfig honorCipherOrder="true" ciphersprotocols="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384+TLSv1.2,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,TLS_ECDH_ECDSA_WITH_RC4_128_SHA,TLS_ECDH_RSA_WITH_RC4_128_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,TLS_EMPTY_RENEGOTIATION_INFO_SCSVF+TLSv1.3" certificateVerification="none">
<Certificate certificateKeystoreTypecertificateKeyAlias="Windows-MYhttps" certificateKeystoreFile="" certificateKeyAliascertificateKeystoreType="httpsWindows-MY"/>
</SSLHostConfig>
</Connector>
TheModifying SSLthe certificatecertificateKeystoreFile needspath toand becertificateKeystorePassword importedas intoneeded theor Myleveraging userthe accountWindows-MY –certificateKeystoreType Personal using mmc certificate snap-ininstead.
If Make sure that the certconnector has abeen friendlycommented nameout, itremove canthe becomment verifiedcharacters.
Save inthe mmc under cert propertiesfile.
Restart Thethe friendlyISEC7 nameSPHERE isWeb case sensitiveservice.
Discussion
Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered.
This requirement applies only to those applications that are either distributed or can allow access to data non-locallynonlocally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, applications need to leverage transmission protection mechanisms, such as TLS, TLS VPNs, or IPSEC.
Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.
V-224793CAT IITomcat SSL must be restricted except for ISEC7 SPHERE tasks.Title, Check text, Fix text, Discussion
Title
Tomcat SSL must be restricted except for ISEC7 SPHEMMRE Suite tasks.
Check text
Verify Tomcat SSL is restricted to only ISEC7 EMMSPHERE Suite tasks.
Log in to the ISEC7 EMMSPHERE Suite server.
Navigate to <Drive>:1ProgramFiles1ISEC7 EMM Suite1Tomcat1conf1SPHERE1Tomcat1conf1.
Edit the web.xml file with Notepad.exe.
Verify the following entries are present:
<security-constraint>
<web-resource-collection>
<web-resource-name>Unsecure</web-resource-name>
<!-- Agent -->
<url-pattern>/BNator/agent/*</url-pattern>
<url-pattern>/app/agent/*</url-pattern>
<url-pattern>/app/admin/agentinstaller.jnlp</url-pattern>
<!-- Client -->
<url-pattern>/app/clients/*</url-pattern>
<url-pattern>/app/data/*</url-pattern>
<!-- Remote Control -->
<url-pattern>/rc/*</url-pattern>
<!-- Traffic Push -->
<url-pattern>/BNator/uss/trafficinfo/*</url-pattern>
<url-pattern>/BNator/data/mds/trafficpush</url-pattern>
<url-pattern>/BNator/favorites/*</url-pattern>
<url-pattern>/app/resource/*</url-pattern>
</web-resource-collection>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>Secure</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
If Tomcat SSL is not restricted to only ISEC7 EMMSPHERE Suite tasks, this is a finding.
Fix text
To restrict Tomcat SSL to only ISEC7 EMMSPHERE Suite tasks, run the ISEC7 integrated installer or use the following manual procedure:
To restrict SSL for all users except for agent task, the user needs to add a security constraint tag to <Drive>:1ProgramFiles1ISEC7 EMM Suite1Tomcat1conf1webSPHERE1Tomcat1conf1web.xml.
LoginLog in to the ISEC7 EMMSPHERE Suite server.
Navigate to <Drive>:1ProgramFiles1ISEC7 EMM Suite1Tomcat1conf1SPHERE1Tomcat1conf1.
Edit the web.xml file with Notepad.exe.
Add the following entry:
<security-constraint>
<web-resource-collection>
<web-resource-name>Unsecure</web-resource-name>
<!-- Agent -->
<url-pattern>/BNator/agent/*</url-pattern>
<url-pattern>/app/agent/*</url-pattern>
<url-pattern>/app/admin/agentinstaller.jnlp</url-pattern>
<!-- Client -->
<url-pattern>/app/clients/*</url-pattern>
<url-pattern>/app/data/*</url-pattern>
<!-- Remote Control -->
<url-pattern>/rc/*</url-pattern>
<!-- Traffic Push -->
<url-pattern>/BNator/uss/trafficinfo/*</url-pattern>
<url-pattern>/BNator/data/mds/trafficpush</url-pattern>
<url-pattern>/BNator/favorites/*</url-pattern>
<url-pattern>/app/resource/*</url-pattern>
</web-resource-collection>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>Secure</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
Discussion
Restricting the use of SSL helps ensure only authorized users and processes have access to Tomcat Web apps and reduces the attack surface of the ISEC7 EMM Suite. Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered.
This requirement applies only to those applications that are either distributed or can allow access to data non-locallynonlocally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, applications need to leverage transmission protection mechanisms, such as TLS, TLS VPNs, or IPSEC.
Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa.
V-225096CAT IThe ISEC7 Sphere server must be maintained at a supported version.Check text, Fix text, Discussion
Check text
Review the ISEC7 Sphere server version after logging into the console. Correlate the version with the latest supported version of ISEC7 Sphere server.
If the installed version of ISEC7 Sphere server is not a supported version, this is a finding.
Fix text
The administrator must check https://www.isec7-us.com/emm-suite-mobile-monitoring
for the latest supported and unsupported versions of software.
Once confirmed, the administrator must update ISEC7 Sphere server to the latest supported version.
Discussion
Versions of ISEC7 Sphere server are maintained by ISEC7 for specific periods of time. Unsupported versions will not receive security updates for new vulnerabilities which leaves them subject to exploitation. A list of supported ISEC7 Sphere server versions is maintained by ISEC7 here: https://www.isec7-us.com/emm-suite-mobile-monitoring.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V3R1 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.