The application server must protect against an individual falsely denying having performed a particular action.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35135	SRG-APP-000080-AS-000045	SV-46422r1_rule		Medium

Description
Non-repudiation of actions taken is required in order to maintain application integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. Non-repudiation protects individuals against later claims by an author of not having authored a particular document, a sender of not having transmitted a message, a receiver of not having received a message, or a signatory of not having signed a document. Typical application server actions requiring non-repudiation will be related to application deployment among developer/users and administrative actions taken by admin personnel.

Description

Non-repudiation of actions taken is required in order to maintain application integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. Non-repudiation protects individuals against later claims by an author of not having authored a particular document, a sender of not having transmitted a message, a receiver of not having received a message, or a signatory of not having signed a document. Typical application server actions requiring non-repudiation will be related to application deployment among developer/users and administrative actions taken by admin personnel.

STIG	Date
Application Server Security Requirements Guide	2013-01-08

Details

Check Text ( C-43523r1_chk )
Review AS product documentation and server configuration to determine if the system can protect against an individual falsely denying having performed a particular action. Perform functionality testing and examine log data to ensure administrative actions such as application deployment and configuration changes are attributable to individuals. If the system cannot perform this function this is a finding.

Check Text ( C-43523r1_chk )

Review AS product documentation and server configuration to determine if the system can protect against an individual falsely denying having performed a particular action. Perform functionality testing and examine log data to ensure administrative actions such as application deployment and configuration changes are attributable to individuals. If the system cannot perform this function this is a finding.

Fix Text (F-39687r1_fix)
Configure the AS to protect against an individual falsely denying having performed a particular action.