STIGQter: STIG Summary: ISEC7 Sphere Security Technical Implementation Guide Version: 3 Release: 1 Benchmark Date: 24 Oct 2024:

The ISEC7 SPHERE must accept Personal Identity Verification (PIV) credentials.

DISA Rule

SV-224769r1013821_rule

Vulnerability Number

V-224769

Group Title

SRG-APP-000391

Rule Version

ISEC-06-001730

Severity

CAT III

CCI(s)

• CCI-001953 - Accepts Personal Identity Verification-compliant credentials.

Weight

10

Fix Recommendation

Log in to the ISEC7 SPHERE Console.
Navigate to Administration >> Configuration >> LDAP.
Check "Also enable user certificate logins. e.g. from smart cards (CAC)".
Check "Only allow certificates with extended key usage for smartcard logon (1.3.6.1.4.1.311.20.2.2)".

Browse to %Install Drive%/Program Files >> ISEC7 SPHERE >> Tomcat >> conf.
Open the server.xml file and add clientAuth="required" under the Connection.

Check Contents

Log in to the ISEC7 SPHERE Console.

Navigate to Administration >> Configuration >> Settings.

Verify the CAC login box has been checked.

On the ISEC7 SPHERE server, browse to the install directory.
Default is %Install Drive%/Program Files/ISEC7 SPHERE
Select the conf folder.
Open config.properties and confirm the following lines exist:

cacUserUIDRegex=^CN=[^0-9]*\\.([0-9]+),
cacUserUIDProperty=UserPrincipalName

Browse to %Install Drive%/Program Files >> ISEC7 SPHERE >> Tomcat >> conf
Confirm the server.xml file has clientAuth="required" under the Connection.

If the required commands do not exist in config.properties or if clientAuth does not ="required" in the server.xml file, this is a finding.

Vulnerability Number

V-224769

Documentable

False

Rule Version

ISEC-06-001730

Severity Override Guidance

Log in to the ISEC7 SPHERE Console.

Navigate to Administration >> Configuration >> Settings.

Verify the CAC login box has been checked.

On the ISEC7 SPHERE server, browse to the install directory.
Default is %Install Drive%/Program Files/ISEC7 SPHERE
Select the conf folder.
Open config.properties and confirm the following lines exist:

cacUserUIDRegex=^CN=[^0-9]*\\.([0-9]+),
cacUserUIDProperty=UserPrincipalName

Browse to %Install Drive%/Program Files >> ISEC7 SPHERE >> Tomcat >> conf
Confirm the server.xml file has clientAuth="required" under the Connection.

If the required commands do not exist in config.properties or if clientAuth does not ="required" in the server.xml file, this is a finding.

Check Content Reference

M

Target Key

4200