The designer shall ensure encrypted assertions, or equivalent confidentiality protections, when assertion data is passed through an intermediary, and confidentiality of the assertion data is required to pass through the intermediary.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-19705	APP3900	SV-21846r1_rule	IAIA-2	Medium

Description
The confidentially of the data in a message as the message is passed through an intermediary web service may be required to be restricted by the intermediary web service. The intermediary web service may leak or distribute the data contained in a message if not encrypted or protected.

STIG	Date
Application Security and Development Checklist	2013-07-16

Details

Check Text ( C-24102r1_chk )
If the application does not utilize WS-Security tokens, this check is not applicable. Ask the application representative for the design document. Review the design document for web services using WS-Security tokens. Review the design document and verify all WS-Security tokens are only transmitted after both receiving and sending services have been mutually PKI authenticated. 1) If the design document does not exist, or does not indicate all WS-Security tokens are only transmitted after both receiving and sending services have been mutually PKI authenticated, it is a finding.

Check Text ( C-24102r1_chk )

If the application does not utilize WS-Security tokens, this check is not applicable.

Ask the application representative for the design document. Review the design document for web services using WS-Security tokens. Review the design document and verify all WS-Security tokens are only transmitted after both receiving and sending services have been mutually PKI authenticated.

1) If the design document does not exist, or does not indicate all WS-Security tokens are only transmitted after both receiving and sending services have been mutually PKI authenticated, it is a finding.

Fix Text (F-23061r1_fix)
Encrypt assertions or use equivalent confidentiality when sensitive assertion data is passed through an intermediary.