ColdFusion must provide a clustering capability.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-62477	CF11-05-000173	SV-76967r1_rule		Medium

Description
Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. When application failure is encountered, preserving application state facilitates application restart and return to the operational mode of the organization with less disruption of mission/business processes. Clustering of multiple ColdFusion servers is a common approach to providing fail-safe application availability when the system criticality requires redundancy.

Description

Failure to a known secure state helps prevent a loss of confidentiality, integrity, or availability in the event of a failure of the information system or a component of the system. When application failure is encountered, preserving application state facilitates application restart and return to the operational mode of the organization with less disruption of mission/business processes. Clustering of multiple ColdFusion servers is a common approach to providing fail-safe application availability when the system criticality requires redundancy.

STIG	Date
Adobe ColdFusion 11 Security Technical Implementation Guide	2016-09-21

Details

Check Text ( C-63281r1_chk )
This requirement is dependent upon system mission criticality. If the system is not mission critical and does not require redundancy, this finding is not applicable. Within the Administrator Console, navigate to the "Cluster Manager" under the "Enterprise Manager" menu. Verify that there are configured clusters with more than 1 server in each cluster. If there are no clusters defined or there is only one server in the cluster, this is a finding.

Check Text ( C-63281r1_chk )

This requirement is dependent upon system mission criticality.

If the system is not mission critical and does not require redundancy, this finding is not applicable.

Within the Administrator Console, navigate to the "Cluster Manager" under the "Enterprise Manager" menu. Verify that there are configured clusters with more than 1 server in each cluster.

If there are no clusters defined or there is only one server in the cluster, this is a finding.

Fix Text (F-68397r1_fix)
Navigate to the "Cluster Manager" under the "Enterprise Manager" menu. Create a cluster by defining a name and adding it to the configured clusters. Edit the cluster to add available servers to the cluster and submit the changes to the cluster.