STIGQter STIGQter: STIG Summary: Oracle WebLogic Server 12c Security Technical Implementation Guide

Version: 1

Release: 6 Benchmark Date: 26 Jul 2019

SV-70459r2_ruleOracle WebLogic must utilize cryptography to protect the confidentiality of remote access management sessions.
SV-70461r2_ruleOracle WebLogic must use cryptography to protect the integrity of the remote access session.
SV-70463r1_ruleOracle WebLogic must employ automated mechanisms to facilitate the monitoring and control of remote access methods.
SV-70465r1_ruleOracle WebLogic must ensure remote sessions for accessing security functions and security-relevant information are audited.
SV-70467r2_ruleOracle WebLogic must support the capability to disable network protocols deemed by the organization to be non-secure except for explicitly identified components in support of specific operational requirements.
SV-70469r1_ruleOracle WebLogic must automatically audit account creation.
SV-70471r1_ruleOracle WebLogic must automatically audit account modification.
SV-70473r1_ruleOracle WebLogic must provide access logging that ensures users who are granted a privileged role (or roles) have their privileged activity logged.
SV-70475r1_ruleOracle WebLogic must limit the number of failed login attempts to an organization-defined number of consecutive invalid attempts that occur within an organization-defined time period.
SV-70477r1_ruleOracle WebLogic must enforce the organization-defined time period during which the limit of consecutive invalid access attempts by a user is counted.
SV-70479r1_ruleOracle WebLogic must automatically lock accounts when the maximum number of unsuccessful login attempts is exceeded for an organization-defined time period or until the account is unlocked by an administrator.
SV-70481r1_ruleOracle WebLogic must protect against an individual falsely denying having performed a particular action.
SV-70483r1_ruleOracle WebLogic must compile audit records from multiple components within the system into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance.
SV-70485r1_ruleOracle WebLogic must generate audit records for the DoD-selected list of auditable events.
SV-70487r1_ruleOracle WebLogic must produce process events and severity levels to establish what type of HTTPD-related events and severity levels occurred.
SV-70489r1_ruleOracle WebLogic must produce audit records containing sufficient information to establish what type of JVM-related events and severity levels occurred.
SV-70491r1_ruleOracle WebLogic must produce process events and security levels to establish what type of Oracle WebLogic process events and severity levels occurred.
SV-70493r1_ruleOracle WebLogic must produce audit records containing sufficient information to establish when (date and time) the events occurred.
SV-70495r1_ruleOracle WebLogic must produce audit records containing sufficient information to establish where the events occurred.
SV-70497r1_ruleOracle WebLogic must produce audit records containing sufficient information to establish the sources of the events.
SV-70499r1_ruleOracle WebLogic must produce audit records that contain sufficient information to establish the outcome (success or failure) of application server and application events.
SV-70501r1_ruleOracle WebLogic must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.
SV-70503r1_ruleOracle WebLogic must provide the ability to write specified audit record content to an audit log server.
SV-70505r1_ruleOracle WebLogic must provide a real-time alert when organization-defined audit failure events occur.
SV-70507r1_ruleOracle WebLogic must alert designated individual organizational officials in the event of an audit processing failure.
SV-70509r1_ruleOracle WebLogic must notify administrative personnel as a group in the event of audit processing failure.
SV-70511r1_ruleOracle WebLogic must use internal system clocks to generate time stamps for audit records.
SV-70513r1_ruleOracle WebLogic must synchronize with internal information system clocks which, in turn, are synchronized on an organization-defined frequency with an organization-defined authoritative time source.
SV-70515r1_ruleOracle WebLogic must protect audit information from any type of unauthorized read access.
SV-70517r1_ruleOracle WebLogic must protect audit tools from unauthorized access.
SV-70519r1_ruleOracle WebLogic must protect audit tools from unauthorized modification.
SV-70521r1_ruleOracle WebLogic must protect audit tools from unauthorized deletion.
SV-70523r1_ruleOracle WebLogic must limit privileges to change the software resident within software libraries (including privileged programs).
SV-70525r1_ruleOracle WebLogic must adhere to the principles of least functionality by providing only essential capabilities.
SV-70527r2_ruleOracle WebLogic must prohibit or restrict the use of unauthorized functions, ports, protocols, and/or services.
SV-70529r1_ruleOracle WebLogic must utilize automated mechanisms to prevent program execution on the information system.
SV-70531r1_ruleOracle WebLogic must uniquely identify and authenticate users (or processes acting on behalf of users).
SV-70533r1_ruleOracle WebLogic must authenticate users individually prior to using a group authenticator.
SV-70535r1_ruleOracle WebLogic must enforce minimum password length.
SV-70537r1_ruleOracle WebLogic must enforce password complexity by the number of upper-case characters used.
SV-70539r1_ruleOracle WebLogic must enforce password complexity by the number of lower-case characters used.
SV-70541r1_ruleOracle WebLogic must enforce password complexity by the number of numeric characters used.
SV-70543r1_ruleOracle WebLogic must enforce password complexity by the number of special characters used.
SV-70545r1_ruleOracle WebLogic must encrypt passwords during transmission.
SV-70547r1_ruleOracle WebLogic must utilize encryption when using LDAP for authentication.
SV-70549r2_ruleOracle WebLogic, when utilizing PKI-based authentication, must validate certificates by constructing a certification path with status information to an accepted trust anchor.
SV-70551r1_ruleOracle WebLogic must map the PKI-based authentication identity to the user account.
SV-70553r3_ruleOracle WebLogic must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when encrypting stored data.
SV-70555r3_ruleOracle WebLogic must utilize FIPS 140-2 approved encryption modules when authenticating users and processes.
SV-70557r2_ruleOracle WebLogic must employ cryptographic encryption to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications.
SV-70559r2_ruleOracle WebLogic must employ strong identification and authentication techniques when establishing nonlocal maintenance and diagnostic sessions.
SV-70561r1_ruleOracle WebLogic must terminate the network connection associated with a communications session at the end of the session or after a DoD-defined time period of inactivity.
SV-70563r2_ruleOracle WebLogic must establish a trusted communications path between the user and organization-defined security functions within the information system.
SV-70567r3_ruleOracle WebLogic must utilize NSA-approved cryptography when protecting classified compartmentalized data.
SV-70569r1_ruleOracle WebLogic must protect the integrity and availability of publicly available information and applications.
SV-70571r1_ruleOracle WebLogic must separate hosted application functionality from Oracle WebLogic management functionality.
SV-70575r1_ruleOracle WebLogic must ensure authentication of both client and server during the entire session.
SV-70577r1_ruleOracle WebLogic must terminate user sessions upon user logout or any other organization- or policy-defined session termination events such as idle time limit exceeded.
SV-70581r1_ruleOracle WebLogic must be configured to perform complete application deployments.
SV-70583r2_ruleOracle WebLogic must protect the confidentiality of applications and leverage transmission protection mechanisms, such as TLS and SSL VPN, when deploying applications.
SV-70587r1_ruleOracle WebLogic must protect the integrity of applications during the processes of data aggregation, packaging, and transformation in preparation for deployment.
SV-70591r1_ruleOracle WebLogic must protect against or limit the effects of HTTP types of Denial of Service (DoS) attacks.
SV-70595r1_ruleOracle WebLogic must limit the use of resources by priority and not impede the host from servicing processes designated as a higher-priority.
SV-70597r1_ruleOracle WebLogic must fail securely in the event of an operational failure.
SV-70601r2_ruleOracle WebLogic must employ approved cryptographic mechanisms when transmitting sensitive data.
SV-70605r1_ruleOracle WebLogic must identify potentially security-relevant error conditions.
SV-70631r1_ruleOracle WebLogic must only generate error messages that provide information necessary for corrective actions without revealing sensitive or potentially harmful information in error logs and administrative messages.
SV-70633r1_ruleOracle WebLogic must restrict error messages so only authorized personnel may view them.
SV-70635r1_ruleOracle WebLogic must provide system notifications to a list of response personnel who are identified by name and/or role.
SV-70637r1_ruleOracle WebLogic must be integrated with a tool to monitor audit subsystem failure notification information that is sent out (e.g., the recipients of the message and the nature of the failure).
SV-70639r1_ruleOracle WebLogic must be managed through a centralized enterprise tool.
SV-70641r1_ruleOracle WebLogic must be integrated with a tool to implement multi-factor user authentication.