DISA_STIG_IBM_WebSphere_Traditional_9_v2r1_Middleware.audit from DISA IBM WebSphere Traditional V9.x v2r1 STIG

WBSP-AS-000010 - The WebSphere Application Server maximum in-memory session count must be set according to application requirements.

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-255818r960735_rule

STIG-ID|WBSP-AS-000010

STIG-Legacy|SV-95907

STIG-Legacy|V-81193

Vuln-ID|V-255818

WBSP-AS-000020 - The WebSphere Application Server admin console session timeout must be configured.

800-53|AC-12

CCI|CCI-002361

Rule-ID|SV-255819r1043182_rule

STIG-ID|WBSP-AS-000020

STIG-Legacy|SV-95909

STIG-Legacy|V-81195

Vuln-ID|V-255819

WBSP-AS-000070 - The WebSphere Application Server security auditing must be enabled.

800-53|AC-6(9)

800-53|AC-17(1)

800-53|AU-10

800-53|AU-14(1)

800-53|SI-11a.

800-53|SI-11b.

CCI|CCI-000067

CCI|CCI-000166

CCI|CCI-001312

CCI|CCI-001314

CCI|CCI-001464

CCI|CCI-002234

Rule-ID|SV-255820r960765_rule

STIG-ID|WBSP-AS-000070

STIG-Legacy|SV-95917

STIG-Legacy|V-81203

Vuln-ID|V-255820

WBSP-AS-000080 - The WebSphere Application Server groups in the user registry mapped to WebSphere auditor roles must be configured in accordance with the security plan.

Rule-ID|SV-255821r960765_rule

STIG-ID|WBSP-AS-000080

STIG-Legacy|SV-95919

STIG-Legacy|V-81205

Vuln-ID|V-255821

WBSP-AS-000090 - The WebSphere Application Server users in the WebSphere auditor role must be configured in accordance with the System Security Plan.

800-53|AU-12b.

CCI|CCI-000171

Rule-ID|SV-255822r960765_rule

STIG-ID|WBSP-AS-000090

STIG-Legacy|SV-95921

STIG-Legacy|V-81207

Vuln-ID|V-255822

WBSP-AS-000100 - The WebSphere Application Server audit event type filters must be configured.

800-53|AU-3

800-53|AU-3(1)

800-53|AU-12a.

800-53|AU-12c.

800-53|AU-14(2)

800-53|CM-5(1)

CCI|CCI-000130

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000169

CCI|CCI-000172

CCI|CCI-001462

CCI|CCI-001487

CCI|CCI-001814

Rule-ID|SV-255823r960765_rule

STIG-ID|WBSP-AS-000100

STIG-Legacy|SV-95923

STIG-Legacy|V-81209

Vuln-ID|V-255823

WBSP-AS-000110 - The WebSphere Application Server audit service provider must be enabled.

Rule-ID|SV-255824r960765_rule

STIG-ID|WBSP-AS-000110

STIG-Legacy|SV-95925

STIG-Legacy|V-81211

Vuln-ID|V-255824

WBSP-AS-000120 - The WebSphere Application Server automatic repository checkpoints must be enabled to track configuration changes

Rule-ID|SV-255825r960765_rule

STIG-ID|WBSP-AS-000120

STIG-Legacy|SV-95911

STIG-Legacy|V-81197

Vuln-ID|V-255825

WBSP-AS-000130 - The WebSphere Application Server administrative security must be enabled.

CAT|I

CCI|CCI-002314

Rule-ID|SV-255826r961278_rule

STIG-ID|WBSP-AS-000130

STIG-Legacy|SV-95913

STIG-Legacy|V-81199

Vuln-ID|V-255826

WBSP-AS-000140 - The WebSphere Application Server bus security must be enabled.

800-53|AC-17(3)

800-53|CM-6b.

CCI|CCI-000366

CCI|CCI-002315

Rule-ID|SV-255827r961863_rule

STIG-ID|WBSP-AS-000140

STIG-Legacy|SV-95915

STIG-Legacy|V-81201

Vuln-ID|V-255827

WBSP-AS-000150 - The WebSphere Application Server users in a local user registry group must be authorized for that group.

800-53|AC-3

800-53|CM-5(6)

800-53|IA-2(5)

CCI|CCI-000213

CCI|CCI-000770

CCI|CCI-001499

CCI|CCI-001813

Rule-ID|SV-255828r961278_rule

STIG-ID|WBSP-AS-000150

STIG-Legacy|SV-95927

STIG-Legacy|V-81213

Vuln-ID|V-255828

WBSP-AS-000160 - The WebSphere Application Server Quality of Protection (QoP) must be set to use TLSv1.2 or higher.

800-53|AC-17(2)

CCI|CCI-000068

Rule-ID|SV-255829r960759_rule

STIG-ID|WBSP-AS-000160

STIG-Legacy|SV-95929

STIG-Legacy|V-81215

Vuln-ID|V-255829

WBSP-AS-000170 - The WebSphere Application Server global application security must be enabled

800-53|IA-5(1)(c)

CCI|CCI-000197

Rule-ID|SV-255830r960759_rule

STIG-ID|WBSP-AS-000170

STIG-Legacy|SV-95931

STIG-Legacy|V-81217

Vuln-ID|V-255830

WBSP-AS-000180 - The WebSphere Application Server Single Sign On (SSO) must have SSL enabled for Web and SIP Security.

800-53|IA-3

CCI|CCI-000778

Rule-ID|SV-255831r960759_rule

STIG-ID|WBSP-AS-000180

STIG-Legacy|SV-95933

STIG-Legacy|V-81219

Vuln-ID|V-255831

WBSP-AS-000190 - The WebSphere Application Server security cookies must be set to HTTPOnly.

CCI|CCI-001453

Rule-ID|SV-255832r960762_rule

STIG-ID|WBSP-AS-000190

STIG-Legacy|SV-95935

STIG-Legacy|V-81221

Vuln-ID|V-255832

WBSP-AS-000211 - The WebSphere Application Server Java 2 security must be enabled.

Rule-ID|SV-255833r1137578_rule

STIG-ID|WBSP-AS-000211

STIG-Legacy|SV-95937

STIG-Legacy|V-81223

Vuln-ID|V-255833

WBSP-AS-000212 - The WebSphere Application Server Java 2 security must not be bypassed.

Rule-ID|SV-255834r1137578_rule

STIG-ID|WBSP-AS-000212

STIG-Legacy|SV-95939

STIG-Legacy|V-81225

Vuln-ID|V-255834

WBSP-AS-000220 - The WebSphere Application Server users in the admin role must be authorized.

800-53|AC-6(10)

CCI|CCI-002235

Rule-ID|SV-255835r1137578_rule

STIG-ID|WBSP-AS-000220

STIG-Legacy|SV-95941

STIG-Legacy|V-81227

Vuln-ID|V-255835

WBSP-AS-000230 - The WebSphere Application Server LDAP groups must be authorized for the WebSphere role.

Rule-ID|SV-255836r1137578_rule

STIG-ID|WBSP-AS-000230

STIG-Legacy|SV-95943

STIG-Legacy|V-81229

Vuln-ID|V-255836

WBSP-AS-000240 - The WebSphere Application Server users in a LDAP user registry group must be authorized for that group.

Rule-ID|SV-255837r961353_rule

STIG-ID|WBSP-AS-000240

STIG-Legacy|SV-95945

STIG-Legacy|V-81231

Vuln-ID|V-255837

WBSP-AS-000310 - The WebSphere Application Server management interface must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.

800-53|AC-8a.

CCI|CCI-000048

Rule-ID|SV-255838r960843_rule

STIG-ID|WBSP-AS-000310

STIG-Legacy|SV-95947

STIG-Legacy|V-81233

Vuln-ID|V-255838

WBSP-AS-000320 - The WebSphere Application Server management interface must retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.

800-53|AC-8b.

CCI|CCI-000050

Rule-ID|SV-255839r960846_rule

STIG-ID|WBSP-AS-000320

STIG-Legacy|SV-95949

STIG-Legacy|V-81235

Vuln-ID|V-255839

WBSP-AS-000380 - The WebSphere Application Server must generate log records when successful/unsuccessful attempts to access subject privileges occur.

Detections

Analytics

DISA IBM WebSphere Traditional 9 STIG v2r1 Middleware

Audit Details

File Details

Audit Changelog

No revisions found