The application server must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35738	SRG-APP-000033-AS-000024	SV-47025r3_rule		Medium

Description
Strong access controls are critical to securing the application server. Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) must be employed by the application server to control access between users (or processes acting on behalf of users) and objects (e.g., applications, files, records, processes, application domains) in the application server. Without stringent logical access and authorization controls, an adversary may have the ability, with very little effort, to compromise the application server and associated supporting infrastructure.

Description

Strong access controls are critical to securing the application server. Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) must be employed by the application server to control access between users (or processes acting on behalf of users) and objects (e.g., applications, files, records, processes, application domains) in the application server. Without stringent logical access and authorization controls, an adversary may have the ability, with very little effort, to compromise the application server and associated supporting infrastructure.

STIG	Date
Application Server Security Requirements Guide	2015-08-28

Details

Check Text ( C-44081r2_chk )
Review application server product documentation and configuration to determine if the system enforces authorization requirements for logical access to the system in accordance with applicable policy. If the application server is not configured to utilize access controls or follow access control policies, this is a finding.

Fix Text (F-40281r2_fix)
Configure the application server to enforce access control policies for logical access to the system in accordance with applicable policy.