OpenControls Logo

STIG Viewer

STIGViewer Support

IDMS must protect against the use web services that do not require a sign on when actions are performed that may be audited.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-251598IDMS-DB-000180SV-251598r960864_ruleCCI-000166low
Description
IDMS web services provide a way for web-based applications to access an IDMS database. If not secured, the Web services interface could be used to reveal or change sensitive data.
STIGDate
CA IDMS Security Technical Implementation Guide2024-09-13

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-09Non-Repudiation
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (53) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00

+43 more (top 10 by confidence shown)

CCI1 mapping
CCI-000166
1.00

Details

Check Text (C-251598r960864_chk)

On the IDMS CV system where CA IDMS Web Services executes, enter "WEBC" to check Web Services configuration. If "REQUIRE SIGNON = NO", this is a finding.

Fix Text (F-54987r807660_fix)

On the IDMS CV system where CA IDMS Web Services executes, enter "WEBC REQUIRE SIGNON=YES".