Unnecessary built-in application accounts must be disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-70401	APSC-DV-003270	SV-85023r1_rule		Medium

Description
Default passwords and properties of built-in accounts are often publicly available. Anyone with necessary knowledge, internal or external, can compromise an application using built-in accounts. Built-in accounts are those that are added as part of the installation of the application software. These accounts exist for many common Commercial Off-the-Shelf (COTS) or open source components of enterprise applications (e.g., OS, web browser or database software).

Description

Default passwords and properties of built-in accounts are often publicly available. Anyone with necessary knowledge, internal or external, can compromise an application using built-in accounts. Built-in accounts are those that are added as part of the installation of the application software. These accounts exist for many common Commercial Off-the-Shelf (COTS) or open source components of enterprise applications (e.g., OS, web browser or database software).

STIG	Date
Application Security and Development Security Technical Implementation Guide	2018-12-24

Details

Check Text ( C-70855r1_chk )
Review the application documentation and identify if the application creates or utilizes built-in accounts. Examine the account list for obvious examples (e.g., accounts with vendor names such as Oracle or Tivoli). Verify that these accounts have been removed or disabled. If enabled built-in accounts are present, ask the application representative the reason for their existence. If the account is required in order for the application to operate properly, verify the account password has been changed to a DoD acceptable value. If these accounts are not necessary to run the application, or if the accounts are required and the password has not been changed to meet DoD password requirements, this is a finding.

Check Text ( C-70855r1_chk )

Review the application documentation and identify if the application creates or utilizes built-in accounts.

Examine the account list for obvious examples (e.g., accounts with vendor names such as Oracle or Tivoli).

Verify that these accounts have been removed or disabled.

If enabled built-in accounts are present, ask the application representative the reason for their existence.

If the account is required in order for the application to operate properly, verify the account password has been changed to a DoD acceptable value.

If these accounts are not necessary to run the application, or if the accounts are required and the password has not been changed to meet DoD password requirements, this is a finding.

Fix Text (F-76637r1_fix)
Disable unnecessary built-in userids, use other strong authentication when possible and use strong passwords if accounts are necessary for application operation.