The application server must mutually authenticate web services-based devices when establishing a connection.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35306	SRG-APP-000158-AS-000108	SV-46593r1_rule		High

Description
Device authentication requires unique identification and authentication that may be defined by type, by specific device, or by a combination of type and device. Device authentication is accomplished via the use of certificates and protocols such as SSL mutual authentication. Device authentication is performed when the AS is providing web services capabilities and data protection requirements mandate the need to establish the identity of the connecting device otherwise known as the consumer.

Description

Device authentication requires unique identification and authentication that may be defined by type, by specific device, or by a combination of type and device. Device authentication is accomplished via the use of certificates and protocols such as SSL mutual authentication. Device authentication is performed when the AS is providing web services capabilities and data protection requirements mandate the need to establish the identity of the connecting device otherwise known as the consumer.

STIG	Date
Application Server Security Requirements Guide	2013-01-08

Details

Check Text ( C-43675r1_chk )
Review AS documentation, application data protection requirements and configuration to ensure the AS provides an SSL mutual authentication capability. If data protection requirements require mutual authentication and the AS is not configured to meet this requirement, this is a finding.

Fix Text (F-39852r1_fix)
Configure the AS to perform mutual authentication of web service consumers as required by application design.