The underlying IIS platform must be configured for Smart Card (CAC) Authorization.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-253516	DCAV-00-000057	SV-253516r836523_rule		High

Description
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: (i) Something a user knows (e.g., password/PIN); (ii) Something a user has (e.g., cryptographic identification device, token); or (iii) Something a user is (e.g., biometric). Multifactor authentication decreases the attack surface by virtue of the fact that attackers must obtain two factors, a physical token or a biometric and a PIN, in order to authenticate. It is not enough to simply steal a user's password to obtain access. A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet).

Description

Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: (i) Something a user knows (e.g., password/PIN); (ii) Something a user has (e.g., cryptographic identification device, token); or (iii) Something a user is (e.g., biometric). Multifactor authentication decreases the attack surface by virtue of the fact that attackers must obtain two factors, a physical token or a biometric and a PIN, in order to authenticate. It is not enough to simply steal a user's password to obtain access. A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet).

STIG	Date
AvePoint DocAve 6 Security Technical Implementation Guide	2022-08-24

Details

Check Text ( C-56968r836521_chk )
Check the Web Server (IIS) features required for Client Certificate Authentication are installed. - On the DocAve 6 Manager server, open Server Manager, then click add/remove roles. - Expand Web Server (IIS) >> Web Server >> Security. - Verify that the "Client Certificate Mapping Authentication" and "Windows Authentication" features are installed. If the features are not installed, this is a finding. On the DocAve Manager server, open IIS Manager. - Expand Sites and select the site used for DocAve. The default site name is DocAve6. - Open the SSL Settings of [DocAve6] site under IIS. - Verify the "Require SSL" checkbox is selected. - Verify the "Require" radio button under "Client Certificates" is selected. Return to the Site Settings Home. If the "Require SSL" checkbox is not selected, or the "Require" radio button under "Client Certificates" is not selected, this is a finding. - Open the Authentication Settings of [DocAve6] site under IIS. - Verify "Windows Authentication", is set to "Enable". Return to the Site Settings Home. If "Windows Authentication", is not set to "Enable", this is a finding. - Expand the [DocAve6] site, select Trust. - Open the SSL Settings under IIS. - Check the "Require SSL" checkbox. - Select the "Require" radio button under "Client Certificates". Return to the Site Settings Home. If the "Require SSL" checkbox is not selected, or the "Require" radio button under "Client Certificates" is not selected, this is a finding.

Check Text ( C-56968r836521_chk )

Check the Web Server (IIS) features required for Client Certificate Authentication are installed.
- On the DocAve 6 Manager server, open Server Manager, then click add/remove roles.
- Expand Web Server (IIS) >> Web Server >> Security.
- Verify that the "Client Certificate Mapping Authentication" and "Windows Authentication" features are installed.

If the features are not installed, this is a finding.

On the DocAve Manager server, open IIS Manager.
- Expand Sites and select the site used for DocAve. The default site name is DocAve6.
- Open the SSL Settings of [DocAve6] site under IIS.
- Verify the "Require SSL" checkbox is selected.
- Verify the "Require" radio button under "Client Certificates" is selected. Return to the Site Settings Home.

If the "Require SSL" checkbox is not selected, or the "Require" radio button under "Client Certificates" is not selected, this is a finding.

- Open the Authentication Settings of [DocAve6] site under IIS.
- Verify "Windows Authentication", is set to "Enable". Return to the Site Settings Home.

If "Windows Authentication", is not set to "Enable", this is a finding.

- Expand the [DocAve6] site, select Trust.
- Open the SSL Settings under IIS.
- Check the "Require SSL" checkbox.
- Select the "Require" radio button under "Client Certificates". Return to the Site Settings Home.

If the "Require SSL" checkbox is not selected, or the "Require" radio button under "Client Certificates" is not selected, this is a finding.

Fix Text (F-56919r836522_fix)
Install the Web Server (IIS) features required for Client Certificate Authentication. - On the DocAve 6 Manager server, open Server Manager, then click add/remove roles. - Expand Web Server (IIS) >> Web Server >> Security. - Install the "Client Certificate Mapping Authentication" and "Windows Authentication" features. On the DocAve Manager server, open IIS Manager. - Expand Sites and select the site used for DocAve. The default site name is DocAve6. - Open the SSL Settings of [DocAve6] site under IIS. - Check the "Require SSL" checkbox. - Select the "Require" radio button under "Client Certificates". Return to the Site Settings Home. - Open the Authentication Settings of [DocAve6] site under IIS. - Highlight "Windows Authentication" and select "Enable". Return to the Site Settings Home. - Expand the [DocAve6] site, select Trust. - Open the SSL Settings under IIS. - Check the "Require SSL" checkbox. - Select the "Require" radio button under "Client Certificates". Return to the Site Settings Home. - Restart the [DocAve6] Application Pool and Web Site.

Fix Text (F-56919r836522_fix)

Install the Web Server (IIS) features required for Client Certificate Authentication.
- On the DocAve 6 Manager server, open Server Manager, then click add/remove roles.
- Expand Web Server (IIS) >> Web Server >> Security.
- Install the "Client Certificate Mapping Authentication" and "Windows Authentication" features.

On the DocAve Manager server, open IIS Manager.
- Expand Sites and select the site used for DocAve. The default site name is DocAve6.
- Open the SSL Settings of [DocAve6] site under IIS.
- Check the "Require SSL" checkbox.
- Select the "Require" radio button under "Client Certificates". Return to the Site Settings Home.
- Open the Authentication Settings of [DocAve6] site under IIS.
- Highlight "Windows Authentication" and select "Enable". Return to the Site Settings Home.
- Expand the [DocAve6] site, select Trust.
- Open the SSL Settings under IIS.
- Check the "Require SSL" checkbox.
- Select the "Require" radio button under "Client Certificates". Return to the Site Settings Home.
- Restart the [DocAve6] Application Pool and Web Site.