The application server must employ automated mechanisms to facilitate the monitoring and control of remote access methods.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35091	SRG-APP-000016-AS-000011	SV-46378r1_rule		Medium

Description
Remote network access is accomplished by leveraging common communication protocols and establishing a remote connection. Application servers provide remote management access and need to provide the ability to facilitate the monitoring and control of remote user sessions. This includes the capability to directly trigger actions based on user activity, or pass information to a separate application or entity that can then perform automated tasks based on the information. Examples of automated mechanisms include but are not limited to; automated monitoring of log activity associated with remote access or process monitoring tools. The AS must employ mechanisms that allow for monitoring and control of web based and command line based administrative remote sessions.

Description

Remote network access is accomplished by leveraging common communication protocols and establishing a remote connection. Application servers provide remote management access and need to provide the ability to facilitate the monitoring and control of remote user sessions. This includes the capability to directly trigger actions based on user activity, or pass information to a separate application or entity that can then perform automated tasks based on the information. Examples of automated mechanisms include but are not limited to; automated monitoring of log activity associated with remote access or process monitoring tools. The AS must employ mechanisms that allow for monitoring and control of web based and command line based administrative remote sessions.

STIG	Date
Application Server Security Requirements Guide	2013-01-08

Details

Check Text ( C-43478r2_chk )
Review the AS configuration to determine that the system is employing automated mechanisms to facilitate the monitoring and control of web based or command line based remote access administrative connections. If the system is not employing automated monitoring and control mechanisms, this is a finding.

Fix Text (F-39642r2_fix)
Configure the AS to facilitate monitoring and control of web based or command line based administrative connections.