An Application Configuration Guide must be created and included with the application.

From Application Security and Development Security Technical Implementation Guide

Part of ASDV-PL-003285

Associated with: CCI-003124

SV-85027r1_rule An Application Configuration Guide must be created and included with the application.

Vulnerability discussion

The Application Configuration Guide is any document or collection of documents used to configure the application. These documents may be part of a user guide, secure configuration guide, or any guidance that satisfies the requirements provided herein. Configuration examples include but are not limited to: - Encryption Settings - PKI Certificate Configuration Settings - Password Settings - Auditing configuration - AD configuration - Backup and disaster recovery settings - List of hosting enclaves and network connection requirements - Deployment configuration settings - Known security assumptions, implications, system level protections, best practices, and required permissionsDevelopment systems, build systems, and test systems must operate in a standardized environment. These settings are to be documented in the Application Configuration Guide.Examples include but are not limited to: - List of development systems, build systems, and test systems. - Versions of compilers used - Build options when creating applications and components - Versions of COTS software (used as part of the application) - Operating systems and versions - For web applications, which browsers and what versions are supported. All deployment configuration settings are to be documented in the Application Configuration Guide and the Application Configuration Guide must be made available to application hosting providers and application/system administrators.

Check content

Interview the application administrator. Request and review the Application Configuration Guide. Verify the configuration guide at a minimum provides configuration details for the following examples. The examples provided herein are not intended to limit the configuration settings that are documented in the guide. Configuration examples include but are not limited to: - Encryption Settings - PKI Certificate Configuration Settings - Password Settings - Auditing configuration - AD configuration - Backup and disaster recovery settings - List of hosting enclaves and network connection requirements - Deployment configuration settings - Known security assumptions, implications, system level protections, best practices, and required permissions Review the Application Configuration Guide and determine if development systems are documented. If no development is being performed where the application is hosted, this part of the requirement is NA. Development systems, build systems, and test systems must operate in a standardized environment. Examples include but are not limited to: - List of development systems, build systems, and test systems. - Versions of compilers used - Build options when creating applications and components - Versions of COTS software (used as part of the application) - Operating systems and versions - For web applications, which browsers and what versions are supported. If there is no application configuration guide included with the application, this is a finding.

Fix text

Create the application configuration guide in accordance with configuration examples provided in the vulnerability discussion and check. Verify the application configuration guide is distributed along with the application.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer