Ax-OS must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-276005 | AXOS-00-000025 | SV-276005r1122665_rule | CCI-000213 | medium |
| Description | ||||
| Strong access controls are critical to securing the application server. The application server must employ access control policies (e.g., identity-based, role-based, and attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, and cryptography) to control access between users (or processes acting on behalf of users) and objects (e.g., applications, files, records, processes, and application domains) in the application server. Without stringent logical access and authorization controls, an adversary may have the ability, with little effort, to compromise the application server and associated supporting infrastructure. Satisfies: SRG-APP-000033, SRG-APP-000158, SRG-APP-000211, SRG-APP-000233, SRG-APP-000340, SRG-APP-000342, SRG-APP-000328, SRG-APP-000380, SRG-APP-000386, SRG-APP-000472, SRG-APP-000473, SRG-APP-000715, SRG-APP-000720, SRG-APP-000725, SRG-APP-000730, SRG-APP-000735 | ||||
| STIG | Date | |||
| Axonius Federal Systems Ax-OS Security Technical Implementation Guide | 2025-11-25 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
AC-3
1.00
- DISA · V1R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.1.1
1.00
- DISA · V1R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.1.2
1.00
- DISA · V1R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000213
1.00
- DISA · V1R2 · disa_xccdf · related
Details
Check Text (C-276005r1122665_chk)
Role-Based Access Control hierarchy is to be defined by the authorizing official (AO). Separation of duties must be configured.
Select the gear icon (System Settings) >> Access Management >> LDAP & SAML.
Depending on the multifactor type configured, under LDAP or SAML, locate "User Assignment Settings".
If only one assigned role exists, this is a finding.
Fix Text (F-80048r1122664_fix)
Role-Based Access Control hierarchy is to be defined by the AO. Separation of duties must be configured.
Select the gear icon (System Settings) >> Access Management >> LDAP & SAML.
Depending on the multifactor type configured, under LDAP or SAML, locate "User Assignment Settings".
Assign two or more roles as defined by the AO and tie them to an LDAP/SAML user or group.