The application server must support the capability to disable network protocols deemed by the organization to be nonsecure except for explicitly identified components in support of specific operational requirements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35094	SRG-APP-000020-AS-000014	SV-46381r1_rule		Medium

Description
Some networking protocols may not meet organizational security requirements to protect data and components. Application servers natively host a number of various features such as management interfaces, httpd servers and message queues. These features all run on TCPIP ports. This creates the potential that the vendor may choose to utilize port numbers or network services that have been deemed unusable by the organization. The application server must have the capability to both reconfigure and disable the assigned ports without adversely impacting application server operation capabilities. For a list of approved ports and protocols, reference the DoD ports and protocols web site at https://powhatan.iiie.disa.mil/ports/cal.html

Description

Some networking protocols may not meet organizational security requirements to protect data and components. Application servers natively host a number of various features such as management interfaces, httpd servers and message queues. These features all run on TCPIP ports. This creates the potential that the vendor may choose to utilize port numbers or network services that have been deemed unusable by the organization. The application server must have the capability to both reconfigure and disable the assigned ports without adversely impacting application server operation capabilities. For a list of approved ports and protocols, reference the DoD ports and protocols web site at https://powhatan.iiie.disa.mil/ports/cal.html

STIG	Date
Application Server Security Requirements Guide	2013-01-08

Details

Check Text ( C-43482r3_chk )
Review the AS product documentation and server configuration to ensure only organization defined network protocols are enabled. Explicitly identified components deemed necessary to support operation requirements are allowed. If networking protocols that have not been approved by the organization are enabled or cannot be disabled without negatively impacting AS operation, this is a finding.

Fix Text (F-39646r2_fix)
Configure the AS to disable use of organization defined networking protocols deemed to be non-secure except for explicitly identified protocols in support of operational requirements.