The designer will ensure SOAP messages requiring integrity, sign the following message elements: -Message ID -Service Request -Timestamp -SAML Assertion (optionally included in messages)

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-19701	APP3860	SV-21842r1_rule	ECTM-1	Medium

Description
Digitally signed SOAP messages provide message integrity and authenticity of the signer of the message independent of the transport layer. Service requests may be intercepted and changed in transit and the data integrity may be at risk if the SOAP message is not digitally signed.

STIG	Date
Application Security and Development STIG	2014-04-03

Details

Check Text ( C-24098r1_chk )
If the application does not utilize SOAP messages, this check is not applicable. Ask the application representative for the design document. Review the design document for web services using SOAP messages. Review the design document and verify the message elements Message ID, Service Request, Timestamp and SAML Assertion are signed. 1) If the design document does not exists or does not indicate the entire SOAP messages requiring integrity do not have the appropriate fields, it is a finding.

Check Text ( C-24098r1_chk )

If the application does not utilize SOAP messages, this check is not applicable.

Ask the application representative for the design document. Review the design document for web services using SOAP messages. Review the design document and verify the message elements Message ID, Service Request, Timestamp and SAML Assertion are signed.

1) If the design document does not exists or does not indicate the entire SOAP messages requiring integrity do not have the appropriate fields, it is a finding.

Fix Text (F-23098r1_fix)
Sign the following message elements for SOAP messages requiring integrity: -Message ID -Service Request -Timestamp -SAML Assertion.