Administrative users and groups that have access rights to the web server are documented.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2257	WA120	SV-2257r1_rule		Low

Description
There are typically several individuals and groups that are involved in running a production web site. In most cases, we can identify several types of users on a web server. These are the System Administrators (SAs), Web Managers, Auditors, Authors, Developers, and the Clients. Nonetheless, only necessary user and administrative accounts will be allowed on the web server. Accounts will be restricted to those who are necessary to maintain web services, review the server’s operation and the operating system. Owing to the sensitivity of web servers, a detailed record of these accounts must be maintained.

Description

There are typically several individuals and groups that are involved in running a production web site. In most cases, we can identify several types of users on a web server. These are the System Administrators (SAs), Web Managers, Auditors, Authors, Developers, and the Clients. Nonetheless, only necessary user and administrative accounts will be allowed on the web server. Accounts will be restricted to those who are necessary to maintain web services, review the server’s operation and the operating system. Owing to the sensitivity of web servers, a detailed record of these accounts must be maintained.

STIG	Date
IIS 7.0 Server STIG	2019-03-22

Details

Check Text ( C-29090r1_chk )
Determine if the local sites' documentation matches an examination of the privileged IDs on the server. Using User Manager, User Manager for Domains, or Local Users and Groups, examine user accounts to verify the above information. If documentation does not exist for users and groups found on the server, this is a finding.

Fix Text (F-26819r1_fix)
Document the administrative users and groups which have access rights to the web server in the website SOP or an equivalent document.