STIGQter STIGQter: STIG Summary: CA API Gateway ALG Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 28 Apr 2017:

The CA API Gateway providing user authentication intermediary services must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

DISA Rule

SV-85973r1_rule

Vulnerability Number

V-71349

Group Title

SRG-NET-000138-ALG-000063

Rule Version

CAGW-GW-000300

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Open the CA API Gateway - Policy Manager and double-click each of the Registered Services that require authentication of organizational users that do not have the required "Access Control" Assertions.

Add the "Authenticate Against Identity Provider" as well as a Credential Source such as "Require HTTP Basic Credentials" or "Require WS - Security Username Token Profile Credentials" from the list of "Access Control" Assertions.

Click "Save and Activate" to activate the updated policy for the Registered Services.

Check Contents

Open the CA API Gateway - Policy Manager and double-click each of the Registered Services that require authentication of organizational users.

Check the Registered Services for the existence of an Authentication Mechanism using an Access Control Assertion such as "Authenticate Against Identity Provider".

Also validate that a Credential Source is added from the Access Control Assertions, such as "Require HTTP Basic Credentials" or "Require WS - Security Username Token Profile Credentials".

If it is not, this is a finding.

Vulnerability Number

V-71349

Documentable

False

Rule Version

CAGW-GW-000300

Severity Override Guidance

Open the CA API Gateway - Policy Manager and double-click each of the Registered Services that require authentication of organizational users.

Check the Registered Services for the existence of an Authentication Mechanism using an Access Control Assertion such as "Authenticate Against Identity Provider".

Also validate that a Credential Source is added from the Access Control Assertions, such as "Require HTTP Basic Credentials" or "Require WS - Security Username Token Profile Credentials".

If it is not, this is a finding.

Check Content Reference

M

Target Key

3049

Comments