STIGQter: STIG Summary: AvePoint DocAve 6 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 24 Aug 2022:

The underlying IIS platform must be configured for Smart Card (CAC) Authorization.

DISA Rule

SV-253516r836523_rule

Vulnerability Number

V-253516

Group Title

SRG-APP-000149

Rule Version

DCAV-00-000057

Severity

CAT I

CCI(s)

• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.

Weight

10

Fix Recommendation

Install the Web Server (IIS) features required for Client Certificate Authentication.
- On the DocAve 6 Manager server, open Server Manager, then click add/remove roles.
- Expand Web Server (IIS) >> Web Server >> Security.
- Install the "Client Certificate Mapping Authentication" and "Windows Authentication" features.

On the DocAve Manager server, open IIS Manager.
- Expand Sites and select the site used for DocAve. The default site name is DocAve6.
- Open the SSL Settings of [DocAve6] site under IIS.
- Check the "Require SSL" checkbox.
- Select the "Require" radio button under "Client Certificates". Return to the Site Settings Home.
- Open the Authentication Settings of [DocAve6] site under IIS.
- Highlight "Windows Authentication" and select "Enable". Return to the Site Settings Home.
- Expand the [DocAve6] site, select Trust.
- Open the SSL Settings under IIS.
- Check the "Require SSL" checkbox.
- Select the "Require" radio button under "Client Certificates". Return to the Site Settings Home.
- Restart the [DocAve6] Application Pool and Web Site.

Check Contents

Check the Web Server (IIS) features required for Client Certificate Authentication are installed.
- On the DocAve 6 Manager server, open Server Manager, then click add/remove roles.
- Expand Web Server (IIS) >> Web Server >> Security.
- Verify that the "Client Certificate Mapping Authentication" and "Windows Authentication" features are installed.

If the features are not installed, this is a finding.

On the DocAve Manager server, open IIS Manager.
- Expand Sites and select the site used for DocAve. The default site name is DocAve6.
- Open the SSL Settings of [DocAve6] site under IIS.
- Verify the "Require SSL" checkbox is selected.
- Verify the "Require" radio button under "Client Certificates" is selected. Return to the Site Settings Home.

If the "Require SSL" checkbox is not selected, or the "Require" radio button under "Client Certificates" is not selected, this is a finding.

- Open the Authentication Settings of [DocAve6] site under IIS.
- Verify "Windows Authentication", is set to "Enable". Return to the Site Settings Home.

If "Windows Authentication", is not set to "Enable", this is a finding.

- Expand the [DocAve6] site, select Trust.
- Open the SSL Settings under IIS.
- Check the "Require SSL" checkbox.
- Select the "Require" radio button under "Client Certificates". Return to the Site Settings Home.

If the "Require SSL" checkbox is not selected, or the "Require" radio button under "Client Certificates" is not selected, this is a finding.

Vulnerability Number

V-253516

Documentable

False

Rule Version

DCAV-00-000057

Severity Override Guidance

Check the Web Server (IIS) features required for Client Certificate Authentication are installed.
- On the DocAve 6 Manager server, open Server Manager, then click add/remove roles.
- Expand Web Server (IIS) >> Web Server >> Security.
- Verify that the "Client Certificate Mapping Authentication" and "Windows Authentication" features are installed.

If the features are not installed, this is a finding.

On the DocAve Manager server, open IIS Manager.
- Expand Sites and select the site used for DocAve. The default site name is DocAve6.
- Open the SSL Settings of [DocAve6] site under IIS.
- Verify the "Require SSL" checkbox is selected.
- Verify the "Require" radio button under "Client Certificates" is selected. Return to the Site Settings Home.

If the "Require SSL" checkbox is not selected, or the "Require" radio button under "Client Certificates" is not selected, this is a finding.

- Open the Authentication Settings of [DocAve6] site under IIS.
- Verify "Windows Authentication", is set to "Enable". Return to the Site Settings Home.

If "Windows Authentication", is not set to "Enable", this is a finding.

- Expand the [DocAve6] site, select Trust.
- Open the SSL Settings under IIS.
- Check the "Require SSL" checkbox.
- Select the "Require" radio button under "Client Certificates". Return to the Site Settings Home.

If the "Require SSL" checkbox is not selected, or the "Require" radio button under "Client Certificates" is not selected, this is a finding.

Check Content Reference

M

Target Key

5472