The application server must use cryptography to protect the integrity of the remote access session.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35090	SRG-APP-000015-AS-000010	SV-46377r1_rule		Medium

Description
Encryption is critical for protection of remote access sessions. If encryption is not being used for integrity, malicious users may gain the ability to modify the AS configuration. The use of cryptography for ensuring integrity of remote access sessions mitigates that risk. Application servers utilize a web management interface and scripted commands when allowing remote access. Web access requires the use of SSL 3.0 or TLS 1.0 and scripted access requires using ssh or some other form of approved cryptography. Application servers must have a capability to enable a secure remote admin capability.

Description

Encryption is critical for protection of remote access sessions. If encryption is not being used for integrity, malicious users may gain the ability to modify the AS configuration. The use of cryptography for ensuring integrity of remote access sessions mitigates that risk. Application servers utilize a web management interface and scripted commands when allowing remote access. Web access requires the use of SSL 3.0 or TLS 1.0 and scripted access requires using ssh or some other form of approved cryptography. Application servers must have a capability to enable a secure remote admin capability.

STIG	Date
Application Server Security Requirements Guide	2013-01-08

Details

Check Text ( C-43477r3_chk )
Review the AS documentation and configuration to ensure the AS is configured to use cryptography to protect the integrity of remote access sessions. If the AS is not configured to use cryptography to protect the integrity of remote access sessions, this is a finding.

Fix Text (F-39641r3_fix)
Configure the AS to utilize encryption during remote access sessions.