Check: APSC-DV-003150
Application Security and Development STIG:
APSC-DV-003150
(in versions v5 r3 through v4 r2)
Title
At least one tester must be designated to test for security flaws in addition to functional testing. (Cat II impact)
Discussion
If there is no person designated to test for security flaws, vulnerabilities can potentially be missed during testing. This requirement is meant to apply to developers or organizations that are doing development work.
Check Content
Review the organization chart and interview the admin staff. Identify personnel designated as application security testers. If the organization operating the application is not doing development work, this requirement is not applicable. If the organization has not designated personnel to conduct security testing, this is a finding.
Fix Text
Designate personnel to conduct security testing on the applications.
Additional Identifiers
Rule ID: SV-222646r879887_rule
Vulnerability ID: V-222646
Group Title: SRG-APP-000516
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000366 |
The organization implements the security configuration settings. |
| CCI-003182 |
The organization requires the developer of the information system, system component, or information system service to perform testing/evaluation of the as-built system, component, or service subsequent to threat and vulnerability analysis. |