STIGQter: STIG Summary: APACHE 2.2 Server for Windows Security Technical Implementation Guide Version: 1 Release: 13 Benchmark Date: 25 Jan 2019:

Administrative users and groups that have access rights to the web server must be documented.

DISA Rule

SV-33017r1_rule

Vulnerability Number

V-2257

Group Title

WA120

Rule Version

WA120 W22

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Document the administrative users and groups which have access rights to the web server in the site SOP or equivalent document.

Check Contents

Proposed Questions:

How many user accounts are associated with the web site operation and maintenance?
Where are these accounts documented?

Working with the SA or the web administrator, determine if the documentation matches an examination of the privileged IDs on the server. Using User Manager, User Manager for Domains, or Local Users and Groups, examine user accounts to verify the above information. Query the SA or the Web Manager regarding the use of each account and each group found on the server.

If the documentation does not match the users and groups found on the server, this is a finding.

Vulnerability Number

V-2257

Documentable

False

Rule Version

WA120 W22

Severity Override Guidance

Proposed Questions:

How many user accounts are associated with the web site operation and maintenance?
Where are these accounts documented?

Working with the SA or the web administrator, determine if the documentation matches an examination of the privileged IDs on the server. Using User Manager, User Manager for Domains, or Local Users and Groups, examine user accounts to verify the above information. Query the SA or the Web Manager regarding the use of each account and each group found on the server.

If the documentation does not match the users and groups found on the server, this is a finding.

Check Content Reference

M

Responsibility

System Administrator

Target Key

158

Comments