UCF STIG Viewer Logo

IDMS must protect against the use of web-based applications that use generic IDs.


Overview

Finding ID Version Rule ID IA Controls Severity
V-251597 IDMS-DB-000170 SV-251597r808349_rule Low
Description
Web-based applications that allow a generic ID can be a door into IDMS allowing unauthorized changes whose authors may not be determined.
STIG Date
CA IDMS Security Technical Implementation Guide 2022-09-07

Details

Check Text ( C-55032r807656_chk )
If there are web-based applications to which individual users sign on, and a generic ID associated with the application is used to access back-end IDMS databases, this is a finding.
Fix Text (F-54986r807657_fix)
For web-based applications using generic IDs, set the individual user ID (external identity) to be recorded in the journal.

For JDBC applications, use the "IdmsConnection setIdentity" method.

For ODBC applications, use the "SQLSetConnectAttr" function with the IDMS_ATTR_EXTERNAL_IDENTITY attribute type.

Run journal report "JREPORT 010" and" JREPORT 008" to audit the individual user ID.