Check: APSC-DV-002880
Application Security and Development STIG:
APSC-DV-002880
(in versions v5 r3 through v4 r2)
Title
The ISSO must ensure an account management process is implemented, verifying only authorized users can gain access to the application, and individual accounts designated as inactive, suspended, or terminated are promptly removed. (Cat II impact)
Discussion
A comprehensive account management process will ensure that only authorized users can gain access to applications and that individual accounts designated as inactive, suspended, or terminated are promptly deactivated. Such a process greatly reduces the risk that accounts will be misused, hijacked, or data compromised.
Check Content
Interview the application representative to verify that a documented process exists for user and system account creation, termination, and expiration. Obtain a list of recently departed personnel and verify that their accounts were removed or deactivated on all systems in a timely manner (e.g., less than two days). If a documented account management process does not exist or unauthorized users have active accounts, this is a finding.
Fix Text
Establish an account management process.
Additional Identifiers
Rule ID: SV-222619r879887_rule
Vulnerability ID: V-222619
Group Title: SRG-APP-000516
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000366 |
The organization implements the security configuration settings. |
| CCI-002121 |
The organization defines the procedures or conditions to be employed when creating, enabling, modifying, disabling, and removing information system accounts. |