What changed in VMware vRealize Operations Manager 6.x tc Server STIG V1R2V1R2 changes

VMware vRealize Operations Manager 6.x tc Server STIG V1R2 (2023-10-25) replaced V1R1 (2018-09-28): 173 checks added, 175 removed. It has 173 checks, against 175 in V1R1.

V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare

  • 173 added
  • 175 removed
  • 0 updated

Added in V1R2 (173)

  • V-241573CAT IItc Server UI must limit the number of maximum concurrent connections permitted.
  • V-241574CAT IItc Server CaSa must limit the number of maximum concurrent connections permitted.
  • V-241575CAT IItc Server API must limit the number of maximum concurrent connections permitted.
  • V-241576CAT IItc Server UI must limit the amount of time that each TCP connection is kept alive.
  • V-241577CAT IItc Server CaSa must limit the amount of time that each TCP connection is kept alive.
  • V-241578CAT IItc Server API must limit the amount of time that each TCP connection is kept alive.
  • V-241579CAT IItc Server UI must limit the number of times that each TCP connection is kept alive.
  • V-241580CAT IItc Server CaSa must limit the number of times that each TCP connection is kept alive.
  • V-241581CAT IItc Server API must limit the number of times that each TCP connection is kept alive.
  • V-241582CAT IItc Server UI must perform server-side session management.
  • V-241583CAT IItc Server CaSa must perform server-side session management.
  • V-241584CAT IItc Server API must perform server-side session management.
  • V-241585CAT IItc Server UI must be configured with FIPS 140-2 compliant ciphers for HTTPS connections.
  • V-241586CAT IItc Server CaSa must be configured with FIPS 140-2 compliant ciphers for HTTPS connections.
  • V-241587CAT IItc Server API must be configured with FIPS 140-2 compliant ciphers for HTTPS connections.
  • V-241588CAT IItc Server UI must use cryptography to protect the integrity of remote sessions.
  • V-241589CAT IItc Server CaSa must use cryptography to protect the integrity of remote sessions.
  • V-241590CAT IItc Server API must use cryptography to protect the integrity of remote sessions.
  • V-241591CAT IItc Server UI must record user access in a format that enables monitoring of remote access.
  • V-241592CAT IItc Server CaSa must record user access in a format that enables monitoring of remote access.
  • V-241593CAT IItc Server API must record user access in a format that enables monitoring of remote access.
  • V-241594CAT IItc Server ALL must generate log records for system startup and shutdown.
  • V-241595CAT IItc Server UI must generate log records for user access and authentication events.
  • V-241596CAT IItc Server CaSa must generate log records for user access and authentication events.
  • V-241597CAT IItc Server API must generate log records for user access and authentication events.
  • V-241598CAT IItc Server ALL must initiate logging during service start-up.
  • V-241599CAT IItc Server UI must produce log records containing sufficient information to establish what type of events occurred.
  • V-241600CAT IItc Server CaSa must produce log records containing sufficient information to establish what type of events occurred.
  • V-241601CAT IItc Server API must produce log records containing sufficient information to establish what type of events occurred.
  • V-241602CAT IItc Server UI must produce log records containing sufficient information to establish when (date and time) events occurred.
  • V-241603CAT IItc Server CaSa must produce log records containing sufficient information to establish when (date and time) events occurred.
  • V-241604CAT IItc Server API must produce log records containing sufficient information to establish when (date and time) events occurred.
  • V-241605CAT IItc Server UI must produce log records containing sufficient information to establish where within the web server the events occurred.
  • V-241606CAT IItc Server CaSa must produce log records containing sufficient information to establish where within the web server the events occurred.
  • V-241607CAT IItc Server API must produce log records containing sufficient information to establish where within the web server the events occurred.
  • V-241608CAT IItc Server UI must produce log records containing sufficient information to establish the source of events.
  • V-241609CAT IItc Server CaSa must produce log records containing sufficient information to establish the source of events.
  • V-241610CAT IItc Server API must produce log records containing sufficient information to establish the source of events.
  • V-241611CAT IItc Server UI must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
  • V-241612CAT IItc Server CaSa must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
  • V-241613CAT IItc Server API must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
  • V-241614CAT IItc Server UI must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
  • V-241615CAT IItc Server CaSa must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
  • V-241616CAT IItc Server API must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
  • V-241617CAT IItc Server UI must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.
  • V-241618CAT IItc Server CaSa must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.
  • V-241619CAT IItc Server API must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.
  • V-241620CAT IItc Server ALL must use a logging mechanism that is configured to alert the ISSO and SA in the event of a processing failure.
  • V-241621CAT IItc Server UI log files must only be accessible by privileged users.
  • V-241622CAT IItc Server CaSa log files must only be accessible by privileged users.
  • V-241623CAT IItc Server API log files must only be accessible by privileged users.
  • V-241624CAT IItc Server UI log files must be protected from unauthorized modification.
  • V-241625CAT IItc Server CaSa log files must be protected from unauthorized modification.
  • V-241626CAT IItc Server API log files must be protected from unauthorized modification.
  • V-241627CAT IItc Server UI log files must be protected from unauthorized deletion.
  • V-241628CAT IItc Server CaSa log files must be protected from unauthorized deletion.
  • V-241629CAT IItc Server API log files must be protected from unauthorized deletion.
  • V-241630CAT IItc Server ALL log data and records must be backed up onto a different system or media.
  • V-241631CAT IItc Server ALL server files must be verified for their integrity (e.g., checksums and hashes) before becoming part of the production web server.
  • V-241632CAT IItc Server ALL expansion modules must be fully reviewed, tested, and signed before they can exist on a production web server.
  • V-241633CAT IItc Server UI must not use the tomcat-users XML database for user management.
  • V-241634CAT IItc Server CaSa must not use the tomcat-users XML database for user management.
  • V-241635CAT IItc Server API must not use the tomcat-users XML database for user management.
  • V-241636CAT IItc Server ALL must only contain services and functions necessary for operation.
  • V-241637CAT Itc Server ALL must exclude documentation, sample code, example applications, and tutorials.
  • V-241638CAT IItc Server ALL must exclude installation of utility programs, services, plug-ins, and modules not necessary for operation.
  • V-241639CAT IItc Server ALL must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.
  • V-241640CAT IItc Server ALL must have all mappings to unused and vulnerable scripts to be removed.
  • V-241641CAT IItc Server UI must have mappings set for Java Servlet Pages.
  • V-241642CAT IItc Server CaSa must have mappings set for Java Servlet Pages.
  • V-241643CAT IItc Server API must have mappings set for Java Servlet Pages.
  • V-241644CAT IItc Server ALL must not have the Web Distributed Authoring (WebDAV) servlet installed.
  • V-241645CAT IItc Server UI must be configured with memory leak protection.
  • V-241646CAT IItc Server CaSa must be configured with memory leak protection.
  • V-241647CAT IItc Server API must be configured with memory leak protection.
  • V-241648CAT Itc Server UI must not have any symbolic links in the web content directory tree.
  • V-241649CAT Itc Server CaSa must not have any symbolic links in the web content directory tree.
  • V-241650CAT Itc Server API must not have any symbolic links in the web content directory tree.
  • V-241651CAT IItc Server UI must be configured to use a specified IP address and port.
  • V-241652CAT IItc Server CaSa must be configured to use a specified IP address and port.
  • V-241653CAT IItc Server API must be configured to use a specified IP address and port.
  • V-241654CAT IItc Server UI must encrypt passwords during transmission.
  • V-241655CAT IItc Server CaSa must encrypt passwords during transmission.
  • V-241656CAT IItc Server API must encrypt passwords during transmission.
  • V-241657CAT IItc Server ALL must validate client certificates, to include all intermediary CAs, to ensure the client-presented certificates are valid and that the entire trust chain is valid. If PKI is not being used, this check is Not Applicable.
  • V-241658CAT IItc Server ALL must only allow authenticated system administrators to have access to the keystore.
  • V-241659CAT IItc Server ALL must only allow authenticated system administrators to have access to the truststore.
  • V-241660CAT IItc Server UI must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when authenticating users and processes.
  • V-241661CAT IItc Server CaSa must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when authenticating users and processes.
  • V-241662CAT IItc Server API must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when authenticating users and processes.
  • V-241663CAT Itc Server UI accounts accessing the directory tree, the shell, or other operating system functions and utilities must be administrative accounts.
  • V-241664CAT Itc Server CaSa accounts accessing the directory tree, the shell, or other operating system functions and utilities must be administrative accounts.
  • V-241665CAT Itc Server API accounts accessing the directory tree, the shell, or other operating system functions and utilities must be administrative accounts.
  • V-241666CAT Itc Server UI web server application directories must not be accessible to anonymous user.
  • V-241667CAT Itc Server CaSa web server application directories must not be accessible to anonymous user.
  • V-241668CAT Itc Server API web server application directories must not be accessible to anonymous user.
  • V-241669CAT IItc Server ALL baseline must be documented and maintained.
  • V-241670CAT IItc Server UI must be built to fail to a known safe state if system initialization fails, shutdown fails, or aborts fail.
  • V-241671CAT IItc Server CaSa must be built to fail to a known safe state if system initialization fails, shutdown fails, or aborts fail.
  • V-241672CAT IItc Server API must be built to fail to a known safe state if system initialization fails, shutdown fails, or aborts fail.
  • V-241673CAT IItc Server UI document directory must be in a separate partition from the web servers system files.
  • V-241674CAT IItc Server CaSa document directory must be in a separate partition from the web servers system files.
  • V-241675CAT IItc Server API document directory must be in a separate partition from the web servers system files.
  • V-241676CAT IItc Server UI must be configured with a cross-site scripting (XSS) filter.
  • V-241677CAT IItc Server CaSa must be configured with a cross-site scripting (XSS) filter.
  • V-241678CAT IItc Server API must be configured with a cross-site scripting (XSS) filter.
  • V-241679CAT IItc Server UI must set URIEncoding to UTF-8.
  • V-241680CAT IItc Server CaSa must set URIEncoding to UTF-8.
  • V-241681CAT IItc Server API must set URIEncoding to UTF-8.
  • V-241682CAT IItc Server UI must use the setCharacterEncodingFilter filter.
  • V-241683CAT IItc Server CaSa must use the setCharacterEncodingFilter filter.
  • V-241684CAT IItc Server API must use the setCharacterEncodingFilter filter.
  • V-241685CAT IItc Server UI must set the welcome-file node to a default web page.
  • V-241686CAT IItc Server CaSa must set the welcome-file node to a default web page.
  • V-241687CAT IItc Server API must set the welcome-file node to a default web page.
  • V-241688CAT IItc Server UI must have the allowTrace parameter set to false.
  • V-241689CAT IItc Server CaSa must have the allowTrace parameter set to false.
  • V-241690CAT IItc Server API must have the allowTrace parameter set to false.
  • V-241691CAT IItc Server UI must have the debug option turned off.
  • V-241692CAT IItc Server CaSa must have the debug option turned off.
  • V-241693CAT IItc Server API must have the debug option turned off.
  • V-241694CAT IItc Server UI must set an inactive timeout for sessions.
  • V-241695CAT IItc Server CaSa must set an inactive timeout for sessions.
  • V-241696CAT IItc Server API must set an inactive timeout for sessions.
  • V-241697CAT Itc Server ALL must be configured to the correct user authentication source.
  • V-241698CAT IItc Server UI must be configured to use the https scheme.
  • V-241699CAT IItc Server CaSa must be configured to use the https scheme.
  • V-241700CAT IItc Server API must be configured to use the https scheme.
  • V-241701CAT IItc Server ALL must use a logging mechanism that is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the web server.
  • V-241702CAT IItc Server ALL log files must be moved to a permanent repository in accordance with site policy.
  • V-241703CAT IItc Server ALL must use a logging mechanism that is configured to provide a warning to the ISSO and SA when allocated record storage volume reaches 75% of maximum log record storage capacity.
  • V-241704CAT IItc Server UI must generate log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
  • V-241705CAT IItc Server CaSa must generate log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
  • V-241706CAT IItc Server API must generate log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
  • V-241707CAT IItc Server UI must record time stamps for log records to a minimum granularity of one second.
  • V-241708CAT IItc Server CaSa must record time stamps for log records to a minimum granularity of one second.
  • V-241709CAT IItc Server API must record time stamps for log records to a minimum granularity of one second.
  • V-241710CAT IItc Server UI application, libraries, and configuration files must only be accessible to privileged users.
  • V-241711CAT IItc Server CaSa application, libraries, and configuration files must only be accessible to privileged users.
  • V-241712CAT IItc Server API application, libraries, and configuration files must only be accessible to privileged users.
  • V-241713CAT IItc Server UI must be configured with the appropriate ports.
  • V-241714CAT IItc Server CaSa must be configured with the appropriate ports.
  • V-241715CAT IItc Server API must be configured with the appropriate ports.
  • V-241716CAT IItc Server UI must use NSA Suite A cryptography when encrypting data that must be compartmentalized.
  • V-241717CAT IItc Server CaSa must use NSA Suite A cryptography when encrypting data that must be compartmentalized.
  • V-241718CAT IItc Server API must use NSA Suite A cryptography when encrypting data that must be compartmentalized.
  • V-241719CAT IItc Server UI must disable the shutdown port.
  • V-241720CAT IItc Server CaSa must disable the shutdown port.
  • V-241721CAT IItc Server API must disable the shutdown port.
  • V-241722CAT IItc Server UI must employ cryptographic mechanisms (TLS/DTLS/SSL) preventing the unauthorized disclosure of information during transmission.
  • V-241723CAT IItc Server CaSa must employ cryptographic mechanisms (TLS/DTLS/SSL) preventing the unauthorized disclosure of information during transmission.
  • V-241724CAT IItc Server API must employ cryptographic mechanisms (TLS/DTLS/SSL) preventing the unauthorized disclosure of information during transmission.
  • V-241725CAT IItc Server UI session IDs must be sent to the client using SSL/TLS.
  • V-241726CAT IItc Server CaSa session IDs must be sent to the client using SSL/TLS.
  • V-241727CAT IItc Server API session IDs must be sent to the client using SSL/TLS.
  • V-241728CAT IItc Server UI must set the useHttpOnly parameter.
  • V-241729CAT IItc Server CaSa must set the useHttpOnly parameter.
  • V-241730CAT IItc Server API must set the useHttpOnly parameter.
  • V-241731CAT IItc Server UI must set the secure flag for cookies.
  • V-241732CAT IItc Server CaSa must set the secure flag for cookies.
  • V-241733CAT IItc Server API must set the secure flag for cookies.
  • V-241734CAT Itc Server UI must set sslEnabledProtocols to an approved Transport Layer Security (TLS) version.
  • V-241735CAT Itc Server CaSa must set sslEnabledProtocols to an approved Transport Layer Security (TLS) version.
  • V-241736CAT Itc Server API must set sslEnabledProtocols to an approved Transport Layer Security (TLS) version.
  • V-241737CAT IItc Server UI must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
  • V-241738CAT IItc Server CaSa must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
  • V-241739CAT IItc Server API must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
  • V-241740CAT IItc Server UI must use approved Transport Layer Security (TLS) versions to maintain the confidentiality and integrity of information during reception.
  • V-241741CAT IItc Server CaSa must use approved Transport Layer Security (TLS) versions to maintain the confidentiality and integrity of information during reception.
  • V-241742CAT IItc Server API must use approved Transport Layer Security (TLS) versions to maintain the confidentiality and integrity of information during reception.
  • V-241743CAT IItc Server ALL must have all security-relevant software updates installed within the configured time period directed by an authoritative source.
  • V-241744CAT IItc Server ALL must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
  • V-258459CAT IThe version of vRealize Operations Manager 6.x tc Server running on the system must be a supported version.

Removed since V1R1 (175)

  • V-88775CAT IItc Server UI must limit the number of maximum concurrent connections permitted.
  • V-88777CAT IItc Server CaSa must limit the number of maximum concurrent connections permitted.
  • V-88779CAT IItc Server API must limit the number of maximum concurrent connections permitted.
  • V-88781CAT IItc Server UI must limit the amount of time that each TCP connection is kept alive.
  • V-88783CAT IItc Server CaSa must limit the amount of time that each TCP connection is kept alive.
  • V-88785CAT IItc Server API must limit the amount of time that each TCP connection is kept alive.
  • V-88787CAT IItc Server UI must limit the number of times that each TCP connection is kept alive.
  • V-88789CAT IItc Server CaSa must limit the number of times that each TCP connection is kept alive.
  • V-88791CAT IItc Server API must limit the number of times that each TCP connection is kept alive.
  • V-88793CAT IItc Server UI must perform server-side session management.
  • V-88795CAT IItc Server CaSa must perform server-side session management.
  • V-88797CAT IItc Server API must perform server-side session management.
  • V-88799CAT IItc Server UI must be configured with FIPS 140-2 compliant ciphers for HTTPS connections.
  • V-88801CAT IItc Server CaSa must be configured with FIPS 140-2 compliant ciphers for HTTPS connections.
  • V-88803CAT IItc Server API must be configured with FIPS 140-2 compliant ciphers for HTTPS connections.
  • V-88805CAT IItc Server UI must use cryptography to protect the integrity of remote sessions.
  • V-88807CAT IItc Server CaSa must use cryptography to protect the integrity of remote sessions.
  • V-88809CAT IItc Server API must use cryptography to protect the integrity of remote sessions.
  • V-88811CAT IItc Server UI must record user access in a format that enables monitoring of remote access.
  • V-88813CAT IItc Server CaSa must record user access in a format that enables monitoring of remote access.
  • V-88815CAT IItc Server API must record user access in a format that enables monitoring of remote access.
  • V-88817CAT IItc Server ALL must generate log records for system startup and shutdown.
  • V-88819CAT IItc Server UI must generate log records for user access and authentication events.
  • V-88821CAT IItc Server CaSa must generate log records for user access and authentication events.
  • V-88823CAT IItc Server API must generate log records for user access and authentication events.
  • V-88825CAT IItc Server ALL must initiate logging during service start-up.
  • V-88827CAT IItc Server UI must capture, record, and log all content related to a user session.
  • V-88829CAT IItc Server CaSa must capture, record, and log all content related to a user session.
  • V-88831CAT IItc Server API must capture, record, and log all content related to a user session.
  • V-88833CAT IItc Server UI must produce log records containing sufficient information to establish what type of events occurred.
  • V-88835CAT IItc Server CaSa must produce log records containing sufficient information to establish what type of events occurred.
  • V-88837CAT IItc Server API must produce log records containing sufficient information to establish what type of events occurred.
  • V-88839CAT IItc Server UI must produce log records containing sufficient information to establish when (date and time) events occurred.
  • V-88841CAT IItc Server CaSa must produce log records containing sufficient information to establish when (date and time) events occurred.
  • V-88843CAT IItc Server API must produce log records containing sufficient information to establish when (date and time) events occurred.
  • V-88845CAT IItc Server UI must produce log records containing sufficient information to establish where within the web server the events occurred.
  • V-88847CAT IItc Server CaSa must produce log records containing sufficient information to establish where within the web server the events occurred.
  • V-88849CAT IItc Server API must produce log records containing sufficient information to establish where within the web server the events occurred.
  • V-88851CAT IItc Server UI must produce log records containing sufficient information to establish the source of events.
  • V-88853CAT IItc Server CaSa must produce log records containing sufficient information to establish the source of events.
  • V-88855CAT IItc Server API must produce log records containing sufficient information to establish the source of events.
  • V-88857CAT IItc Server UI must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
  • V-88859CAT IItc Server CaSa must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
  • V-88861CAT IItc Server API must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.
  • V-88863CAT IItc Server UI must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
  • V-88865CAT IItc Server CaSa must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
  • V-88867CAT IItc Server API must produce log records that contain sufficient information to establish the outcome (success or failure) of events.
  • V-88869CAT IItc Server UI must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.
  • V-88871CAT IItc Server CaSa must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.
  • V-88873CAT IItc Server API must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.
  • V-88875CAT IItc Server ALL must use a logging mechanism that is configured to alert the ISSO and SA in the event of a processing failure.
  • V-88877CAT IItc Server UI log files must only be accessible by privileged users.
  • V-88879CAT IItc Server CaSa log files must only be accessible by privileged users.
  • V-88881CAT IItc Server API log files must only be accessible by privileged users.
  • V-88883CAT IItc Server UI log files must be protected from unauthorized modification.
  • V-88885CAT IItc Server CaSa log files must be protected from unauthorized modification.
  • V-88887CAT IItc Server API log files must be protected from unauthorized modification.
  • V-88889CAT IItc Server UI log files must be protected from unauthorized deletion.
  • V-88891CAT IItc Server CaSa log files must be protected from unauthorized deletion.
  • V-88893CAT IItc Server API log files must be protected from unauthorized deletion.
  • V-88895CAT IItc Server ALL log data and records must be backed up onto a different system or media.
  • V-88897CAT IItc Server ALL server files must be verified for their integrity (e.g., checksums and hashes) before becoming part of the production web server.
  • V-88899CAT IItc Server ALL expansion modules must be fully reviewed, tested, and signed before they can exist on a production web server.
  • V-88901CAT IItc Server UI must not use the tomcat-users XML database for user management.
  • V-88903CAT IItc Server CaSa must not use the tomcat-users XML database for user management.
  • V-88905CAT IItc Server API must not use the tomcat-users XML database for user management.
  • V-88907CAT IItc Server ALL must only contain services and functions necessary for operation.
  • V-88909CAT Itc Server ALL must exclude documentation, sample code, example applications, and tutorials.
  • V-88911CAT IItc Server ALL must exclude installation of utility programs, services, plug-ins, and modules not necessary for operation.
  • V-88913CAT IItc Server ALL must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.
  • V-88915CAT IItc Server ALL must have all mappings to unused and vulnerable scripts to be removed.
  • V-88917CAT IItc Server UI must have mappings set for Java Servlet Pages.
  • V-88919CAT IItc Server CaSa must have mappings set for Java Servlet Pages.
  • V-88921CAT IItc Server API must have mappings set for Java Servlet Pages.
  • V-88923CAT IItc Server ALL must not have the Web Distributed Authoring (WebDAV) servlet installed.
  • V-88925CAT IItc Server UI must be configured with memory leak protection.
  • V-88927CAT IItc Server CaSa must be configured with memory leak protection.
  • V-88929CAT IItc Server API must be configured with memory leak protection.
  • V-88931CAT Itc Server UI must not have any symbolic links in the web content directory tree.
  • V-88933CAT Itc Server CaSa must not have any symbolic links in the web content directory tree.
  • V-88935CAT Itc Server API must not have any symbolic links in the web content directory tree.
  • V-88937CAT IItc Server UI must be configured to use a specified IP address and port.
  • V-88939CAT IItc Server CaSa must be configured to use a specified IP address and port.
  • V-88941CAT IItc Server API must be configured to use a specified IP address and port.
  • V-88943CAT IItc Server UI must encrypt passwords during transmission.
  • V-88945CAT IItc Server CaSa must encrypt passwords during transmission.
  • V-88947CAT IItc Server API must encrypt passwords during transmission.
  • V-88949CAT IItc Server ALL must validate client certificates, to include all intermediary CAs, to ensure the client-presented certificates are valid and that the entire trust chain is valid. If PKI is not being used, this check is Not Applicable.
  • V-88951CAT IItc Server ALL must only allow authenticated system administrators to have access to the keystore.
  • V-88953CAT IItc Server ALL must only allow authenticated system administrators to have access to the truststore.
  • V-88955CAT IItc Server UI must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when authenticating users and processes.
  • V-88957CAT IItc Server CaSa must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when authenticating users and processes.
  • V-88959CAT IItc Server API must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when authenticating users and processes.
  • V-88961CAT Itc Server UI accounts accessing the directory tree, the shell, or other operating system functions and utilities must be administrative accounts.
  • V-88963CAT Itc Server CaSa accounts accessing the directory tree, the shell, or other operating system functions and utilities must be administrative accounts.
  • V-88965CAT Itc Server API accounts accessing the directory tree, the shell, or other operating system functions and utilities must be administrative accounts.
  • V-88967CAT Itc Server UI web server application directories must not be accessible to anonymous user.
  • V-88969CAT Itc Server CaSa web server application directories must not be accessible to anonymous user.
  • V-88971CAT Itc Server API web server application directories must not be accessible to anonymous user.
  • V-88973CAT IItc Server ALL baseline must be documented and maintained.
  • V-88975CAT IItc Server UI must be built to fail to a known safe state if system initialization fails, shutdown fails, or aborts fail.
  • V-88977CAT IItc Server CaSa must be built to fail to a known safe state if system initialization fails, shutdown fails, or aborts fail.
  • V-88979CAT IItc Server API must be built to fail to a known safe state if system initialization fails, shutdown fails, or aborts fail.
  • V-88981CAT IItc Server UI document directory must be in a separate partition from the web servers system files.
  • V-88983CAT IItc Server CaSa document directory must be in a separate partition from the web servers system files.
  • V-88985CAT IItc Server API document directory must be in a separate partition from the web servers system files.
  • V-88987CAT IItc Server UI must be configured with a cross-site scripting (XSS) filter.
  • V-88989CAT IItc Server CaSa must be configured with a cross-site scripting (XSS) filter.
  • V-88991CAT IItc Server API must be configured with a cross-site scripting (XSS) filter.
  • V-88993CAT IItc Server UI must set URIEncoding to UTF-8.
  • V-88995CAT IItc Server CaSa must set URIEncoding to UTF-8.
  • V-88997CAT IItc Server API must set URIEncoding to UTF-8.
  • V-88999CAT IItc Server UI must use the setCharacterEncodingFilter filter.
  • V-89001CAT IItc Server CaSa must use the setCharacterEncodingFilter filter.
  • V-89003CAT IItc Server API must use the setCharacterEncodingFilter filter.
  • V-89005CAT IItc Server UI must set the welcome-file node to a default web page.
  • V-89007CAT IItc Server CaSa must set the welcome-file node to a default web page.
  • V-89009CAT IItc Server API must set the welcome-file node to a default web page.
  • V-89011CAT IItc Server UI must have the allowTrace parameter set to false.
  • V-89013CAT IItc Server CaSa must have the allowTrace parameter set to false.
  • V-89015CAT IItc Server API must have the allowTrace parameter set to false.
  • V-89017CAT IItc Server UI must have the debug option turned off.
  • V-89019CAT IItc Server CaSa must have the debug option turned off.
  • V-89021CAT IItc Server API must have the debug option turned off.
  • V-89023CAT IItc Server UI must set an inactive timeout for sessions.
  • V-89025CAT IItc Server CaSa must set an inactive timeout for sessions.
  • V-89027CAT IItc Server API must set an inactive timeout for sessions.
  • V-89029CAT Itc Server ALL must be configured to the correct user authentication source.
  • V-89031CAT IItc Server UI must be configured to use the https scheme.
  • V-89033CAT IItc Server CaSa must be configured to use the https scheme.
  • V-89035CAT IItc Server API must be configured to use the https scheme.
  • V-89037CAT IItc Server ALL must use a logging mechanism that is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the web server.
  • V-89039CAT IItc Server ALL log files must be moved to a permanent repository in accordance with site policy.
  • V-89041CAT IItc Server ALL must use a logging mechanism that is configured to provide a warning to the ISSO and SA when allocated record storage volume reaches 75% of maximum log record storage capacity.
  • V-89043CAT IItc Server UI must generate log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
  • V-89045CAT IItc Server CaSa must generate log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
  • V-89047CAT IItc Server API must generate log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).
  • V-89049CAT IItc Server UI must record time stamps for log records to a minimum granularity of one second.
  • V-89051CAT IItc Server CaSa must record time stamps for log records to a minimum granularity of one second.
  • V-89053CAT IItc Server API must record time stamps for log records to a minimum granularity of one second.
  • V-89055CAT IItc Server UI application, libraries, and configuration files must only be accessible to privileged users.
  • V-89057CAT IItc Server CaSa application, libraries, and configuration files must only be accessible to privileged users.
  • V-89059CAT IItc Server API application, libraries, and configuration files must only be accessible to privileged users.
  • V-89061CAT IItc Server UI must be configured with the appropriate ports.
  • V-89063CAT IItc Server CaSa must be configured with the appropriate ports.
  • V-89065CAT IItc Server API must be configured with the appropriate ports.
  • V-89067CAT IItc Server UI must use NSA Suite A cryptography when encrypting data that must be compartmentalized.
  • V-89069CAT IItc Server CaSa must use NSA Suite A cryptography when encrypting data that must be compartmentalized.
  • V-89071CAT IItc Server API must use NSA Suite A cryptography when encrypting data that must be compartmentalized.
  • V-89073CAT IItc Server UI must disable the shutdown port.
  • V-89075CAT IItc Server CaSa must disable the shutdown port.
  • V-89077CAT IItc Server API must disable the shutdown port.
  • V-89079CAT IItc Server UI must employ cryptographic mechanisms (TLS/DTLS/SSL) preventing the unauthorized disclosure of information during transmission.
  • V-89081CAT IItc Server CaSa must employ cryptographic mechanisms (TLS/DTLS/SSL) preventing the unauthorized disclosure of information during transmission.
  • V-89083CAT IItc Server API must employ cryptographic mechanisms (TLS/DTLS/SSL) preventing the unauthorized disclosure of information during transmission.
  • V-89085CAT IItc Server UI session IDs must be sent to the client using SSL/TLS.
  • V-89087CAT IItc Server CaSa session IDs must be sent to the client using SSL/TLS.
  • V-89089CAT IItc Server API session IDs must be sent to the client using SSL/TLS.
  • V-89091CAT IItc Server UI must set the useHttpOnly parameter.
  • V-89093CAT IItc Server CaSa must set the useHttpOnly parameter.
  • V-89095CAT IItc Server API must set the useHttpOnly parameter.
  • V-89097CAT IItc Server UI must set the secure flag for cookies.
  • V-89099CAT IItc Server CaSa must set the secure flag for cookies.
  • V-89101CAT IItc Server API must set the secure flag for cookies.
  • V-89103CAT Itc Server UI must set sslEnabledProtocols to an approved Transport Layer Security (TLS) version.
  • V-89105CAT Itc Server CaSa must set sslEnabledProtocols to an approved Transport Layer Security (TLS) version.
  • V-89107CAT Itc Server API must set sslEnabledProtocols to an approved Transport Layer Security (TLS) version.
  • V-89109CAT IItc Server UI must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
  • V-89111CAT IItc Server CaSa must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
  • V-89113CAT IItc Server API must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
  • V-89115CAT IItc Server UI must use approved Transport Layer Security (TLS) versions to maintain the confidentiality and integrity of information during reception.
  • V-89117CAT IItc Server CaSa must use approved Transport Layer Security (TLS) versions to maintain the confidentiality and integrity of information during reception.
  • V-89119CAT IItc Server API must use approved Transport Layer Security (TLS) versions to maintain the confidentiality and integrity of information during reception.
  • V-89121CAT IItc Server ALL must have all security-relevant software updates installed within the configured time period directed by an authoritative source.
  • V-89123CAT IItc Server ALL must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.