STIGQter: STIG Summary: IBM WebSphere Traditional V9.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Aug 2018:

The WebSphere Application Server must authenticate all endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

DISA Rule

SV-96055r1_rule

Vulnerability Number

V-81341

Group Title

SRG-APP-000395-AS-000109

Rule Version

WBSP-AS-001120

Severity

CAT II

CCI(s)

• CCI-001967 - The information system authenticates organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

10

Fix Recommendation

From the admin console, navigate to Security >> SSL Certificate and Key Management >> SSL Configuration.

For each [NodeDefaultSSLSettings] select Quality of Protection (QoP) Settings.

Set "Client authentication" according to the security plan.

Check Contents

Review System Security Plan documentation.

Identify mutual authentication connection requirements.

From the admin console, navigate to Security >> SSL Certificate and Key Management >> SSL Configuration.

Select each [NodeDefaultSSLSettings] then go to Quality of Protection (QoP) Settings.

If "Client authentication" is not set according to the security plan, this is a finding.

Note: with LDAP registry, the entire DN in the certificate is used to look up LDAP. Filters may be configured. With other registries, only the first attribute after the first "=", e.g., CN=<user> is used.

Vulnerability Number

V-81341

Documentable

False

Rule Version

WBSP-AS-001120

Severity Override Guidance

Review System Security Plan documentation.

Identify mutual authentication connection requirements.

From the admin console, navigate to Security >> SSL Certificate and Key Management >> SSL Configuration.

Select each [NodeDefaultSSLSettings] then go to Quality of Protection (QoP) Settings.

If "Client authentication" is not set according to the security plan, this is a finding.

Note: with LDAP registry, the entire DN in the certificate is used to look up LDAP. Filters may be configured. With other registries, only the first attribute after the first "=", e.g., CN=<user> is used.

Check Content Reference

M

Target Key

3399

Comments