STIGQter STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 4 Release: 9 Benchmark Date: 25 Jan 2019: The application must generate audit records for all direct access to the information system.

DISA Rule

SV-84035r1_rule

Vulnerability Number

V-69413

Group Title

SRG-APP-000508

Rule Version

APSC-DV-000870

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the application to log all direct access to the system.

Check Contents

Review the application documentation and interview the application administrator.

Identify if the application implements a direct access feature or function that allows users to directly access the underlying OS.

Direct access includes but is not limited to: executing OS commands, navigating the file system, manipulating system resources such as print queues, or reading files hosted on the OS that are not specifically shared or made available on the website.

If the application does not provide direct access to the system, this requirement is not applicable.

Access the application logs.

Access the application as a user or test user with appropriate permissions and attempt to execute application features and functions that provide direct access to the system.

Review the logs and ensure the actions executed were logged.

Log information must include the user responsible for executing the action, the action executed, and the result of the action.

If the application does not log all direct access to the system, this is a finding.

Vulnerability Number

V-69413

Documentable

False

Rule Version

APSC-DV-000870

Severity Override Guidance

Review the application documentation and interview the application administrator.

Identify if the application implements a direct access feature or function that allows users to directly access the underlying OS.

Direct access includes but is not limited to: executing OS commands, navigating the file system, manipulating system resources such as print queues, or reading files hosted on the OS that are not specifically shared or made available on the website.

If the application does not provide direct access to the system, this requirement is not applicable.

Access the application logs.

Access the application as a user or test user with appropriate permissions and attempt to execute application features and functions that provide direct access to the system.

Review the logs and ensure the actions executed were logged.

Log information must include the user responsible for executing the action, the action executed, and the result of the action.

If the application does not log all direct access to the system, this is a finding.

Check Content Reference

M

Target Key

3009

Comments