Procedures must be in place to notify users when an application is decommissioned.

From Application Security and Development Security Technical Implementation Guide

Associated with: CCI-003374

SV-85021r1_rule Procedures must be in place to notify users when an application is decommissioned.

Vulnerability discussion

When maintenance no longer exists for an application, there are no individuals responsible for making security updates. The application support staff should maintain procedures for decommissioning. The decommissioning process should include notifying users of the pending decommissioning event. If the users are not informed of the decommissioning event, attackers may be able to stand up similar looking system and fool users into attempting to log onto a duplicate system. This can be as simple as a banner informing users.This risk is primarily geared towards insider threat scenarios and externally accessible applications that provide access to publicly releasable data but should also be applied to internal systems as a best practice.

Check content

Interview the application representative to determine if provisions are in place to notify users when an application is decommissioned. If provisions are not in place to notify users when an application is decommissioned, this is a finding.

Fix text

Create and establish procedures to notify users when an application is decommissioned.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.