| Finding ID |
Severity |
Title |
Description |
|
V-256898
|
High |
Automation Controller must implement cryptography mechanisms to protect the integrity of information. |
Encryption is critical for protection of remote access sessions. If encryption is not being used for integrity, malicious users may gain the ability to modify Automation Controller configuration. The use of cryptography for ensuring integrity of remote access sessions mitigates that risk.
Automation Controller utilizes a web management interface and... |
|
V-256911
|
Medium |
Automation Controller must install security-relevant software updates within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs). |
Security relevant software updates must be installed within the timeframes directed by an authoritative source in order to maintain the integrity and confidentiality of the system and its organizational assets. |
|
V-256910
|
Medium |
Automation Controller must only allow the use of DOD PKI-established certificate authorities for verification of the establishment of protected sessions. |
An untrusted source may leave the system vulnerable to issues such as unauthorized access, reduced data integrity, loss of confidentiality, etc.
Satisfies: SRG-APP-000427-AS-000264, SRG-APP-000514-AS-000137 |
|
V-256909
|
Medium |
Automation Controller must compare internal application server clocks at least every 24 hours with an authoritative time source. |
When conducting forensic analysis and investigating system events, it is critical that timestamps accurately reflect the time of application events. If timestamps are not deemed to be accurate, the integrity of the forensic analysis and the associated determinations are at stake. This leaves the organization and the system vulnerable to... |
|
V-256908
|
Medium |
Automation Controller must use cryptographic mechanisms to protect the integrity of log tools. |
Protecting the integrity of the tools used for logging purposes is a critical step in ensuring the integrity of log data. Log data includes all information (e.g., log records, log settings, and log reports) needed to successfully log information system activity.
It is not uncommon for attackers to replace the... |
|
V-256907
|
Medium |
Automation Controller must utilize encryption when using LDAP for authentication. |
To avoid access with malicious intent, passwords will need to be protected at all times. This includes transmission where passwords must be encrypted for security. |
|
V-256906
|
Medium |
Automation Controller must be configured to authenticate users individually, prior to using a group authenticator. |
Default superuser accounts, such as "root", are considered group authenticators. In the case of Automation Controller this is the "admin" account. |
|
V-256905
|
Medium |
Automation Controller must be configured to use an enterprise user management system. |
Unauthenticated application servers render the organization subject to exploitation. Therefore, application servers must be uniquely identified and authenticated to prevent unauthorized access.
Satisfies: SRG-APP-000148-AS-000101, SRG-APP-000149-AS-000102, SRG-APP-000151-AS-000103, SRG-APP-000177-AS-000126, SRG-APP-000389-AS-000253, SRG-APP-000390-AS-000254, SRG-APP-000391-AS-000239, SRG-APP-000392-AS-000240, SRG-APP-000400-AS-000246, SRG-APP-000401-AS-000243, SRG-APP-000402-AS-000247, SRG-APP-000403-AS-000248, SRG-APP-000404-AS-000249, SRG-APP-000405-AS-000250 |
|
V-256904
|
Medium |
Automation Controller must be capable of reverting to the last known good configuration in the event of failed installations and upgrades. |
Any changes to the components of Automation Controller can have significant effects on the overall security of the system.
In order to ensure a prompt response to failed application installations and application server upgrades, Automation Controller must provide an automated rollback capability that allows Automation Controller to be restored to... |
|
V-256903
|
Medium |
Automation Controller's log files must be accessible by explicitly defined privilege. |
A failure of the confidentiality of Automation Controller log files would enable an attacker to identify key information about the system that they might not otherwise be able to obtain that would enable them to enumerate more information to enable escalation or lateral movement.
Satisfies: SRG-APP-000118-AS-000078, SRG-APP-000119-AS-000079, SRG-APP-000120-AS-000080, SRG-APP-000121-AS-000081, SRG-APP-000122-AS-000082,... |
|
V-256902
|
Medium |
Automation Controller must be configured to fail over to another system in the event of log subsystem failure. |
Automation Controller hosts must be capable of failing over to another Automation Controller host which can handle application and logging functions upon detection of an application log processing failure. This will allow continual operation of the application and logging functions while minimizing the loss of operation for the users and... |
|
V-256901
|
Medium |
Automation Controller must allocate log record storage capacity and shut down by default upon log failure (unless availability is an overriding concern). |
It is critical that when a system is at risk of failing to process logs, it detects and takes action to mitigate the failure. Log processing failures include software/hardware errors, failures in the log capturing mechanisms, and log storage capacity being reached or exceeded. During a failure, the application server... |
|
V-256900
|
Medium |
Automation Controller must use external log providers that can collect user activity logs in independent, protected repositories to prevent modification or repudiation. |
Automation Controller must be configured to use external logging to compile log records from multiple components within the server. The events occurring must be time-correlated in order to conduct accurate forensic analysis. In addition, the correlation must meet certain tolerance criteria. For instance, DOD may define that the time stamps... |
|
V-256899
|
Medium |
The Automation Controller management interface must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system. |
Automation Controller is required to display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system management interface, providing privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance that states that:
(i) users are accessing a U.S. Government... |
|
V-256897
|
Medium |
Automation Controller must use encryption strength in accordance with the categorization of the management data during remote access management sessions. |
Remote management access is accomplished by leveraging common communication protocols and establishing a remote connection to the application server via a network for the purposes of managing Automation Controller. If cryptography is not used, then the session data traversing the remote connection could be intercepted and compromised.
Automation Controller is... |
|
V-256896
|
Medium |
Automation Controller must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types. |
Application management includes the ability to control the number of sessions that utilize an application by all accounts and/or account types. Limiting the number of allowed sessions is helpful in limiting risks related to denial-of-service attacks.
Automation Controllers host and expose business logic and application processes.
Automation Controller limits the... |