HPE Fortify WebInspect Compliance Web Application Assessment Report Scan Name: Zero 1 Policy: Standard Crawl Sessions: 600 Scan Date: 10/5/2017 11:35:08 AM Vulnerabilities: 181 Scan Version: 17.10.283.0 Scan Duration: 21 minutes : 23 seconds Scan Type: Site Client: FF Template Name: NIST FISMA SP 800-53 Revision 4 Description: CAUTIONARY NOTE: IMPLEMENTING CHANGES BASED ON REVISIONS TO SPECIAL PUBLICATION 800-53 http://dx.doi.org/10.6028/NIST.SP.800-53r4 When NIST publishes revisions to Special Publication 800-53, there are four primary types of changes made to the document: (i) security controls or control enhancements are added to or withdrawn from Appendices F and G and/or to the low, moderate, and high baselines; (ii) supplemental guidance is modified; (iii) material in the main chapters or appendices is modified; and (iv) language is clarified and/or updated throughout the document. When modifying existing tailored security control baselines at Tier 3 in the risk management hierarchy (as described in Special Publication 800-39) and updating security controls at any tier as a result of Special Publication 800-53 revisions, organizations should take a measured, risk-based approach in accordance with organizational risk tolerance and current risk assessments. Unless otherwise directed by OMB policy, the following activities are recommended to implement changes to Special Publication 800-53: - First, organizations determine if any added security controls/control enhancements are applicable to organizational information systems or environments of operation following tailoring guidelines in this publication. - Next, organizations review changes to the supplemental guidance, guidance in the main chapters and appendices, and updated/clarified language throughout the publication to determine if changes apply to any organizational information systems and if any immediate actions are required. - Finally, once organizations have determined the entirety of changes necessitated by the revisions to the publication, the changes are integrated into the established continuous monitoring process to the greatest extent possible. The implementation of new or modified security controls to address specific, active threats is always the highest priority for sequencing and implementing changes. Modifications such as changes to templates or minor language changes in policy or procedures are generally the lowest priority and are made in conjunction with established review cycles. [HP WebInspect Operator Notes] This compliance template maps the current capabilities of HP WebInspect to applicable controls included in NIST FISMA SP 800-53 Revision 4. Use of this compliance template is not intended to provide a holistic compliance rating; but a guide for application security-relevant components of NIST FISMA SP 800-53 Revision 4. Compliance Summary Passed Failed Indeterminate Percentage AC-3: Access Enforcement The information system enforces approved authorizations for logical 104 2 325 98.1% access to information and system resources in accordance with applicable access control policies. IA-2: Identification and Authentication (Organizational Users) The information system uniquely identifies and authenticates 26 3 158 89.6% organizational users (or processes acting on behalf of organizational users). (8) identification and authentication | network access to privileged 6 0 1 100% accounts - replay resistant The information system implements replay-resistant authentication mechanisms for network access to privileged accounts. (9) identification and authentication | network access to 6 0 1 100% non-privileged accounts - replay resistant The information system implements replay-resistant authentication mechanisms for network access to non-privileged accounts. IA-6: Authenticator Feedback The information system obscures feedback of authentication 12 1 66 92.3% information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals. IA-8: Identification and Authentication (Non-Organizational Users) Report Date: 12/12/2017 2 The information system uniquely identifies and authenticates 26 3 158 89.6% non-organizational users (or processes acting on behalf of non-organizational users). IR-9: Information Spillage Response The organization responds to information spills by: 47 2 4 95.9% a. Identifying the specific information involved in the information system contamination; b. Alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill; c. Isolating the contaminated information system or system component; d. Eradicating the information from the contaminated information system or component; e. Identifying other information systems or system components that may have been subsequently contaminated; and f. Performing other [Assignment: organization-defined actions]. [HP WebInspect Operator Notes] The intent of this category is to alert the HP WebInspect operator of potentially sensitive content that was discovered throughout the execution of the scan. HP WebInspect cannot discern whether information is classified or sensitive with absolute certainty, so further analysis is required above and beyond running HP WebInspect. SC-5: Denial of Service Protection The information system protects against or limits the effects of the 6 0 63 100% following types of denial of service attacks: [Assignment: organization-defined types of denial of service attacks or reference to source for such information] by employing [Assignment: organization-defined security safeguards]. SC-7: Boundary Protection (10) boundary protection | prevent unauthorized exfiltration 5 3 1 62.5% The organization prevents the unauthorized exfiltration of information across managed interfaces. Supplemental Guidance: Safeguards implemented by organizations to prevent unauthorized exfiltration of information from information systems include, for example: (i) strict adherence to protocol formats; (ii) monitoring for beaconing from information systems; (iii) monitoring for steganography; (iv) disconnecting external network interfaces except when explicitly needed; (v) disassembling and reassembling packet headers; and (vi) employing traffic profile analysis to detect deviations from the volume/types of traffic expected within organizations or call backs to command and control centers. Devices enforcing strict adherence to protocol formats include, for example, deep packet inspection firewalls and XML gateways. These devices verify adherence to protocol formats and specification at the application layer and serve to identify vulnerabilities that cannot be detected by devices operating at the network or transport layers. This control enhancement is closely associated with cross-domain solutions and system guards enforcing information flow requirements. Related control: SI-3. SC-8: Transmission Confidentiality and Integrity The information system protects the [Selection (one or more): 15 3 0 83.3% confidentiality; integrity] of transmitted information. SC-18: Mobile Code (1) mobile code | identify unacceptable code / take corrective actions 33 0 2 100% The information system identifies [Assignment: organization-defined unacceptable mobile code] and takes [Assignment: organization-defined corrective actions]. Supplemental Guidance: Corrective actions when unacceptable mobile code is detected include, for example, blocking, quarantine, or alerting administrators. Blocking includes, for example, preventing transmission of word processing files with embedded macros when such macros have been defined to be unacceptable mobile code. Report Date: 12/12/2017 3 such macros have been defined to be unacceptable mobile code. SC-23: Session Authenticity (1) session authenticity | invalidate session identifiers at logout 5 0 0 100% The information system invalidates session identifiers upon user logout or other session termination. Supplemental Guidance: This control enhancement curtails the ability of adversaries from capturing and continuing to employ previously valid session IDs. (3) session authenticity | unique session identifiers with 1 0 1 100% randomization The information system generates a unique session identifier for each session with [Assignment: organization-defined randomness requirements] and recognizes only session identifiers that are system-generated. Supplemental Guidance: This control enhancement curtails the ability of adversaries from reusing previously valid session IDs. Employing the concept of randomness in the generation of unique session identifiers helps to protect against brute-force attacks to determine future session identifiers. Related control: SC-13. SI-10: Information Input Validation (1) information input validation | predictable behavior 437 6 542 98.6% The information system behaves in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received. SI-11: Error Handling The information system: 27 5 12 84.3% a. Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries; and b. Reveals error messages only to [Assignment: organization-defined personnel or roles]. SI-15: Information Output Filtering The information system validates information output from 409 6 422 98.5% [Assignment: organization-defined software programs and/or applications] to ensure that the information is consistent with