The application server must control remote access methods.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-57413	SRG-APP-000315-AS-000094	SV-71685r2_rule		Medium

Description
Application servers provide remote access capability and must be able to enforce remote access policy requirements or work in conjunction with enterprise tools designed to enforce policy requirements. Automated monitoring and control of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by logging connection activities of remote users. Examples of policy requirements include, but are not limited to, authorizing remote access to the information system, limiting access based on authentication credentials, and monitoring for unauthorized access.

Description

Application servers provide remote access capability and must be able to enforce remote access policy requirements or work in conjunction with enterprise tools designed to enforce policy requirements. Automated monitoring and control of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by logging connection activities of remote users. Examples of policy requirements include, but are not limited to, authorizing remote access to the information system, limiting access based on authentication credentials, and monitoring for unauthorized access.

STIG	Date
Application Server Security Requirements Guide	2018-01-08

Details

Check Text ( C-58087r1_chk )
Review organization policy, application server product documentation and configuration to determine if the system enforces the organization's requirements for remote connections. If the system is not configured to enforce these requirements, or the remote connection settings are not in accordance with the requirements, this is a finding.

Fix Text (F-62451r1_fix)
Configure the application server to enforce remote connection settings.