A private websites authentication mechanism must use client certificates to transmit session identifier to assure integrity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-214460	IISW-SI-000220	SV-214460r879609_rule		Medium

Description
A DoD private website must utilize PKI as an authentication mechanism for web users. Information systems residing behind web servers requiring authorization based on individual identity must use the identity provided by certificate-based authentication to support access control decisions. Not using client certificates allows an attacker unauthenticated access to private websites. Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186

Description

A DoD private website must utilize PKI as an authentication mechanism for web users. Information systems residing behind web servers requiring authorization based on individual identity must use the identity provided by certificate-based authentication to support access control decisions. Not using client certificates allows an attacker unauthenticated access to private websites. Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186

STIG	Date
Microsoft IIS 8.5 Site Security Technical Implementation Guide	2022-12-09

Details

Check Text ( C-15669r840132_chk )
Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable. Note: If the server is hosting Exchange, this is Not Applicable. Note: If the server is hosting SharePoint, this is Not Applicable. Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding. Follow the procedures below for each site hosted on the IIS 8.5 web server: Open the IIS 8.5 Manager. Double-click the "SSL Settings" icon. Verify the "Clients Certificate Required" check box is selected. If the "Clients Certificate Required" check box is not selected, this is a finding.

Check Text ( C-15669r840132_chk )

Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable.
Note: If the server is hosting Exchange, this is Not Applicable.
Note: If the server is hosting SharePoint, this is Not Applicable.
Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding.

Follow the procedures below for each site hosted on the IIS 8.5 web server:

Open the IIS 8.5 Manager.

Double-click the "SSL Settings" icon.

Verify the "Clients Certificate Required" check box is selected.

If the "Clients Certificate Required" check box is not selected, this is a finding.

Fix Text (F-15667r840133_fix)
Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable. Note: If the server is hosting Exchange, this is Not Applicable. Note: If the server is hosting SharePoint, this is Not Applicable. Note: If certificate handling is performed at the Proxy/Load Balancer, this is not a finding. Follow the procedures below for each site hosted on the IIS 8.5 web server: Open the IIS 8.5 Manager. Double-click the "SSL Settings" icon. Verify the "Clients Certificate Required" check box is selected. Select "Apply" from the "Actions" pane.

Fix Text (F-15667r840133_fix)