The designer must create and update the Design Document for each release of the application.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-70387	APSC-DV-003220	SV-85009r1_rule		Low

Description
This requirement is meant to apply to developers or organizations that are doing application development work. The application design document or configuration guide includes configuration settings, recommendations and best practices that pertain to the secure deployment of the application. It also contains the detailed functional architecture as well as any changes to the application architecture corresponding to a new version release and must be documented to ensure all risks are assessed and mitigated to the maximum extent practical. Failure to do so may result in unexposed risk, and failure to mitigate the risk leading to failure or compromise of the system.

Description

This requirement is meant to apply to developers or organizations that are doing application development work. The application design document or configuration guide includes configuration settings, recommendations and best practices that pertain to the secure deployment of the application. It also contains the detailed functional architecture as well as any changes to the application architecture corresponding to a new version release and must be documented to ensure all risks are assessed and mitigated to the maximum extent practical. Failure to do so may result in unexposed risk, and failure to mitigate the risk leading to failure or compromise of the system.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2018-12-24

Details

Check Text ( C-70841r1_chk )
This requirement is meant to apply to developers or organizations that are doing application development work. If the organization operating the application is not doing the development or managing the development of the application, the requirement is not applicable. Ask the application representative for the design document for the application. Review the design document. Examine the design document and/or the threat model for the application and verify the following information is documented: - All external interfaces. - The nature of information being exchanged - Any protections on the external interface - User roles required for access control and the access privileges assigned to each role - Unique security requirements (e.g., encryption of key data elements at rest) - Categories of sensitive information processed by the application and their specific protection plans (e.g., PII, HIPAA). - Restoration priority of subsystems, processes, or information - Verify the organization includes documentation describing the design and implementation details of the security controls employed within the information system with sufficient detail - Application incident response plan that provides details on how to provide the development team with application vulnerability or bug information. If the design document is incomplete, this is a finding.

Check Text ( C-70841r1_chk )

This requirement is meant to apply to developers or organizations that are doing application development work. If the organization operating the application is not doing the development or managing the development of the application, the requirement is not applicable.

Ask the application representative for the design document for the application. Review the design document.

Examine the design document and/or the threat model for the application and verify the following information is documented:

- All external interfaces.
- The nature of information being exchanged
- Any protections on the external interface
- User roles required for access control and the access privileges assigned to each role
- Unique security requirements (e.g., encryption of key data elements at rest)
- Categories of sensitive information processed by the application and their specific protection plans (e.g., PII, HIPAA).
- Restoration priority of subsystems, processes, or information
- Verify the organization includes documentation describing the design and implementation details of the security controls employed within the information system with sufficient detail
- Application incident response plan that provides details on how to provide the development team with application vulnerability or bug information.

If the design document is incomplete, this is a finding.

Fix Text (F-76623r1_fix)
Create and maintain the Design Document for each release of the application and identify the following: - All external interfaces (from the threat model) - The nature of information being exchanged - Categories of sensitive information processed or stored and their specific protection plans - The protection mechanisms associated with each interface - User roles required for access control - Access privileges assigned to each role - Unique application security requirements - Categories of sensitive information processed or stored and specific protection plans (e.g., Privacy Act, HIPAA, etc.) - Restoration priority of subsystems, processes, or information.

Fix Text (F-76623r1_fix)

Create and maintain the Design Document for each release of the application and identify the following:

- All external interfaces (from the threat model)
- The nature of information being exchanged
- Categories of sensitive information processed or stored and their specific protection plans
- The protection mechanisms associated with each interface
- User roles required for access control
- Access privileges assigned to each role
- Unique application security requirements
- Categories of sensitive information processed or stored and specific protection plans (e.g., Privacy Act, HIPAA, etc.)
- Restoration priority of subsystems, processes, or information.