The application server must maintain the binding of security attributes to information with sufficient assurance that the information/attribute association can be used as the basis for automated policy actions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35082	SRG-APP-000011-AS-000007	SV-46369r1_rule		Medium

Description
Security attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information. These attributes are typically associated with internal data structures (e.g., records, buffers, files) within the information system and are used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. Examples of application security attributes are classified, FOUO, sensitive, etc. Without the assurance of credential association with the application files or data, policy decisions based on that association become faulty and potentially allow for authorization decisions that are applied incorrectly.

Description

Security attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information. These attributes are typically associated with internal data structures (e.g., records, buffers, files) within the information system and are used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. Examples of application security attributes are classified, FOUO, sensitive, etc. Without the assurance of credential association with the application files or data, policy decisions based on that association become faulty and potentially allow for authorization decisions that are applied incorrectly.

STIG	Date
Application Server Security Requirements Guide	2013-01-08

Details

Check Text ( C-43469r2_chk )
Review system documentation to determine if the AS maintains the binding of digital credentials to information with sufficient assurance that the information--credential association can be used as the basis for automated policy actions. If these bindings are not maintained, this is a finding.

Fix Text (F-39633r3_fix)
Configure the AS to maintain the binding of digital credentials to information with sufficient assurance that the information--credential association can be used as the basis for automated policy actions.