Access privileges to the Configuration Management (CM) repository must be reviewed every three months.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-70341	APSC-DV-003000	SV-84963r1_rule		Medium

Description
A Configuration Management (CM) repository is used to manage application code versions and to securely store application code. Incorrect access privileges to the CM repository can lead to malicious code or unintentional code being introduced into the application. This requirement is intended to be applied to application developers or organizations responsible for code management or who have and operate an application CM repository.

Description

A Configuration Management (CM) repository is used to manage application code versions and to securely store application code. Incorrect access privileges to the CM repository can lead to malicious code or unintentional code being introduced into the application. This requirement is intended to be applied to application developers or organizations responsible for code management or who have and operate an application CM repository.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2018-04-03

Details

Check Text ( C-70795r1_chk )
Review the application system documentation. Interview the application administrator. Identify if development of the application is done in house and if application configuration management repository exists. If application development is not done in house and if a code configuration management repository does not exist, the requirement is not applicable. Review CM management processes and procedures. Verify the CM repository access permissions are reviewed at least every three months. Ask the application administrator or the CM administrator when the last time the CM access privileges were reviewed. If CM access privileges have not been reviewed within the last three months, this is a finding.

Check Text ( C-70795r1_chk )

Review the application system documentation.

Interview the application administrator.

Identify if development of the application is done in house and if application configuration management repository exists.

If application development is not done in house and if a code configuration management repository does not exist, the requirement is not applicable.

Review CM management processes and procedures.

Verify the CM repository access permissions are reviewed at least every three months.

Ask the application administrator or the CM administrator when the last time the CM access privileges were reviewed.

If CM access privileges have not been reviewed within the last three months, this is a finding.

Fix Text (F-76577r1_fix)
Review access privileges to the CM repository at least every three months.