An Application Configuration Guide must be created and included with the application.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-70405	APSC-DV-003285	SV-85027r1_rule		Medium

Description
The Application Configuration Guide is any document or collection of documents used to configure the application. These documents may be part of a user guide, secure configuration guide, or any guidance that satisfies the requirements provided herein. Configuration examples include but are not limited to: - Encryption Settings - PKI Certificate Configuration Settings - Password Settings - Auditing configuration - AD configuration - Backup and disaster recovery settings - List of hosting enclaves and network connection requirements - Deployment configuration settings - Known security assumptions, implications, system level protections, best practices, and required permissions Development systems, build systems, and test systems must operate in a standardized environment. These settings are to be documented in the Application Configuration Guide. Examples include but are not limited to: - List of development systems, build systems, and test systems. - Versions of compilers used - Build options when creating applications and components - Versions of COTS software (used as part of the application) - Operating systems and versions - For web applications, which browsers and what versions are supported. All deployment configuration settings are to be documented in the Application Configuration Guide and the Application Configuration Guide must be made available to application hosting providers and application/system administrators.

Description

The Application Configuration Guide is any document or collection of documents used to configure the application. These documents may be part of a user guide, secure configuration guide, or any guidance that satisfies the requirements provided herein. Configuration examples include but are not limited to: - Encryption Settings - PKI Certificate Configuration Settings - Password Settings - Auditing configuration - AD configuration - Backup and disaster recovery settings - List of hosting enclaves and network connection requirements - Deployment configuration settings - Known security assumptions, implications, system level protections, best practices, and required permissions Development systems, build systems, and test systems must operate in a standardized environment. These settings are to be documented in the Application Configuration Guide. Examples include but are not limited to: - List of development systems, build systems, and test systems. - Versions of compilers used - Build options when creating applications and components - Versions of COTS software (used as part of the application) - Operating systems and versions - For web applications, which browsers and what versions are supported. All deployment configuration settings are to be documented in the Application Configuration Guide and the Application Configuration Guide must be made available to application hosting providers and application/system administrators.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2020-06-12

Details

Check Text ( C-70859r1_chk )
Interview the application administrator. Request and review the Application Configuration Guide. Verify the configuration guide at a minimum provides configuration details for the following examples. The examples provided herein are not intended to limit the configuration settings that are documented in the guide. Configuration examples include but are not limited to: - Encryption Settings - PKI Certificate Configuration Settings - Password Settings - Auditing configuration - AD configuration - Backup and disaster recovery settings - List of hosting enclaves and network connection requirements - Deployment configuration settings - Known security assumptions, implications, system level protections, best practices, and required permissions Review the Application Configuration Guide and determine if development systems are documented. If no development is being performed where the application is hosted, this part of the requirement is NA. Development systems, build systems, and test systems must operate in a standardized environment. Examples include but are not limited to: - List of development systems, build systems, and test systems. - Versions of compilers used - Build options when creating applications and components - Versions of COTS software (used as part of the application) - Operating systems and versions - For web applications, which browsers and what versions are supported. If there is no application configuration guide included with the application, this is a finding.

Check Text ( C-70859r1_chk )

Interview the application administrator. Request and review the Application Configuration Guide.

Verify the configuration guide at a minimum provides configuration details for the following examples. The examples provided herein are not intended to limit the configuration settings that are documented in the guide.

Configuration examples include but are not limited to:

- Encryption Settings
- PKI Certificate Configuration Settings
- Password Settings
- Auditing configuration
- AD configuration
- Backup and disaster recovery settings
- List of hosting enclaves and network connection requirements
- Deployment configuration settings
- Known security assumptions, implications, system level protections, best practices, and required permissions

Review the Application Configuration Guide and determine if development systems are documented. If no development is being performed where the application is hosted, this part of the requirement is NA.

Development systems, build systems, and test systems must operate in a standardized environment.

Examples include but are not limited to:

- List of development systems, build systems, and test systems.
- Versions of compilers used
- Build options when creating applications and components
- Versions of COTS software (used as part of the application)
- Operating systems and versions
- For web applications, which browsers and what versions are supported.

If there is no application configuration guide included with the application, this is a finding.

Fix Text (F-76641r1_fix)
Create the application configuration guide in accordance with configuration examples provided in the vulnerability discussion and check. Verify the application configuration guide is distributed along with the application.