The application server must notify administrators when accounts are created.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35446	SRG-APP-000291-AS-000175	SV-46733r1_rule		Medium

Description
Once an attacker establishes initial access to a system, they often attempt to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Application servers provide either a local user store or they integrate with enterprise user stores like LDAP or Active Directory. When the AS is the authoritative user store, the application server must be able to notify designated individuals when new accounts are created.

Description

Once an attacker establishes initial access to a system, they often attempt to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply create a new account. Application servers provide either a local user store or they integrate with enterprise user stores like LDAP or Active Directory. When the AS is the authoritative user store, the application server must be able to notify designated individuals when new accounts are created.

STIG	Date
Application Server Security Requirements Guide	2013-01-08

Details

Check Text ( C-43800r1_chk )
Review AS product documentation and server configuration to determine if the AS can be configured to notify staff when accounts are created. If the AS is not configured to meet this requirement, this is a finding.

Fix Text (F-39990r1_fix)
Configure the AS to automatically notify appropriate personnel when accounts are created.