SharePoint must implement security functions as largely independent modules to avoid unnecessary interactions between modules.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-28207	SHPT-00-000760	SV-37789r2_rule	DCSP-1	Medium

Description
Microsoft recommends separate Application Pools (and security accounts) for site collections with authenticated and anonymous content; to isolate applications storing security or management information; or where users have great liberty to create and administer sites and to collaborate on content. With this configuration, if an attacker gains control of one Application Pool, they do not gain universal access to all data hosted in the SharePoint farm. Configuring separate Application Pools with the appropriate security based on access and content allows for content isolation and load balancing, limiting access to specific servers. Organizations can use custom HTTP modules for specific zones to create unique sign-on rules based on these groups of users.

Description

Microsoft recommends separate Application Pools (and security accounts) for site collections with authenticated and anonymous content; to isolate applications storing security or management information; or where users have great liberty to create and administer sites and to collaborate on content. With this configuration, if an attacker gains control of one Application Pool, they do not gain universal access to all data hosted in the SharePoint farm. Configuring separate Application Pools with the appropriate security based on access and content allows for content isolation and load balancing, limiting access to specific servers. Organizations can use custom HTTP modules for specific zones to create unique sign-on rules based on these groups of users.

STIG	Date
SharePoint 2010 Security Technical Implementation Guide (STIG)	2012-10-12

Details

Check Text ( C-37389r2_chk )
1. Use the IIS Manager to navigate to the SharePoint Applications Pools and Sites list. 2. Verify the following for SharePoint applications: - Applications are not assigned to the Default Application Pool. - Central Administration is not assigned to an Application Pool with applications that have non-privileged user access. - Internet and Extranet sites are assigned to different Application Pools. Verify the Central Administration Application is in a separate Application Pool. 1. Open IIS Manager. 2. Click Application Pools. 3. Identify the SharePoint Central Administration application. 4. If SharePoint Central Administration is not the only application in the pool, this is a finding.

Check Text ( C-37389r2_chk )

1. Use the IIS Manager to navigate to the SharePoint Applications Pools and Sites list.
2. Verify the following for SharePoint applications:
- Applications are not assigned to the Default Application Pool.
- Central Administration is not assigned to an Application Pool with applications that have non-privileged user access.
- Internet and Extranet sites are assigned to different Application Pools.

Verify the Central Administration Application is in a separate Application Pool.
1. Open IIS Manager.
2. Click Application Pools.
3. Identify the SharePoint Central Administration application.
4. If SharePoint Central Administration is not the only application in the pool, this is a finding.

Fix Text (F-32626r1_fix)
Consult the IIS STIG for further guidance. Either remove applications from the application pool or create a separate application pool for the SharePoint Central Administration site.