Title

The API must authenticate remote commands. (Cat II impact)

Discussion

Authentication safeguards for remote commands help to ensure that information systems accept and execute, in the order intended, only authorized commands and reject unauthorized commands. Cryptographic mechanisms can be employed, for example, to authenticate remote commands. Safeguards include, at a minimum, FIPS-compliant cryptographic hash. Standard API authentication protocols provide this protection (e.g., Oauth 2.0, JWT).

Check Content

Verify the API authenticates remote commands. If the API does not authenticate remote commands, this is a finding.

Fix Text

Build or configure the API to authenticate remote commands.

Additional Identifiers

Rule ID: SV-274723r1143761_rule

Vulnerability ID: V-274723

Group Title: SRG-APP-000461

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.