STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 1 hour ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

IBM WebSphere Traditional V9.x Security Technical Implementation Guide

Version

V2R1

Release Date

Feb 26, 2026

SCAP Benchmark ID

IBM_WebSphere_Traditional_V9-x_STIG

Total Checks

77

Tags

other
CAT I: 9CAT II: 56CAT III: 12

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (77)

V-255818MEDIUMThe WebSphere Application Server maximum in-memory session count must be set according to application requirements.V-255819MEDIUMThe WebSphere Application Server admin console session timeout must be configured.V-255820MEDIUMThe WebSphere Application Server security auditing must be enabled.V-255821MEDIUMThe WebSphere Application Server groups in the user registry mapped to WebSphere auditor roles must be configured in accordance with the security plan.V-255822MEDIUMThe WebSphere Application Server users in the WebSphere auditor role must be configured in accordance with the System Security Plan.V-255823MEDIUMThe WebSphere Application Server audit event type filters must be configured.V-255824MEDIUMThe WebSphere Application Server audit service provider must be enabled.V-255825MEDIUMThe WebSphere Application Server automatic repository checkpoints must be enabled to track configuration changes.V-255826HIGHThe WebSphere Application Server administrative security must be enabled.V-255827HIGHThe WebSphere Application Server bus security must be enabled.V-255828MEDIUMThe WebSphere Application Server users in a local user registry group must be authorized for that group.V-255829MEDIUMThe WebSphere Application Server Quality of Protection (QoP) must be set to use TLSv1.2 or higher.V-255830HIGHThe WebSphere Application Server global application security must be enabled.V-255831HIGHThe WebSphere Application Server Single Sign On (SSO) must have SSL enabled for Web and SIP Security.V-255832MEDIUMThe WebSphere Application Server security cookies must be set to HTTPOnly.V-255833HIGHThe WebSphere Application Server Java 2 security must be enabled.V-255834HIGHThe WebSphere Application Server Java 2 security must not be bypassed.V-255835MEDIUMThe WebSphere Application Server users in the admin role must be authorized.V-255836MEDIUMThe WebSphere Application Server LDAP groups must be authorized for the WebSphere role.V-255837MEDIUMThe WebSphere Application Server users in a LDAP user registry group must be authorized for that group.V-255838MEDIUMThe WebSphere Application Server management interface must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.V-255839MEDIUMThe WebSphere Application Server management interface must retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.V-255840LOWThe WebSphere Application Server must generate log records when successful/unsuccessful attempts to access subject privileges occur.V-255841MEDIUMThe WebSphere Application Server must allocate JVM log record storage capacity in accordance with organization-defined log record storage requirements.V-255842MEDIUMThe WebSphere Application Server must allocate audit log record storage capacity in accordance with organization-defined log record storage requirements.V-255843MEDIUMThe WebSphere Application Server must provide an immediate real-time alert to authorized users of all log failure events requiring real-time alerts.V-255844LOWThe WebSphere Application Server must alert the SA and ISSO, at a minimum, in the event of a log processing failure.V-255845MEDIUMThe WebSphere Application Server audit subsystem failure action must be set to Log warning.V-255846LOWThe WebSphere Application Server must shut down by default upon log failure (unless availability is an overriding concern).V-255847LOWThe WebSphere Application Server high availability applications must be configured to fail over to another system in the event of log subsystem failure.V-255848LOWThe WebSphere Application Server must be configured to protect log information from any type of unauthorized read access.V-255849MEDIUMThe WebSphere Application Server must protect log information from unauthorized modification.V-255850MEDIUMThe WebSphere Application Server must protect log information from unauthorized deletion.V-255851MEDIUMThe WebSphere Application Server wsadmin file must be protected from unauthorized access.V-255852MEDIUMThe WebSphere Application Server wsadmin file must be protected from unauthorized modification.V-255853MEDIUMThe WebSphere Application Server wsadmin file must be protected from unauthorized deletion.V-255854MEDIUMThe WebSphere Application Server must be configured to encrypt log information.V-255855MEDIUMThe WebSphere Application Server must be configured to sign log information.V-255856MEDIUMThe WebSphere Application Server process must not be started from the command line with the -password option.V-255857MEDIUMThe WebSphere Application Server files must be owned by the non-root WebSphere user ID.V-255858LOWThe WebSphere Application Server sample applications must be removed.V-255859LOWThe WebSphere Application Server must remove JREs left by web server and plug-in installers for web servers and plugins running in the DMZ.V-255860MEDIUMThe WebSphere Application Server must be run as a non-admin user.V-255861MEDIUMThe WebSphere Application Server must disable JSP class reloading.V-255862MEDIUMThe WebSphere Application Server must prohibit or restrict the use of nonsecure ports, protocols, modules, and/or services as defined in the PPSM CAL and vulnerability assessments.V-255863MEDIUMThe WebSphere Application Server LDAP user registry must be used.V-255864MEDIUMThe WebSphere Application Server local file-based user registry must not be used.V-255865MEDIUMThe WebSphere Application Server multifactor authentication for network access to privileged accounts must be used.V-255866MEDIUMThe WebSphere Application Server must provide security extensions to extend the SOAP protocol and provide secure authentication when accessing sensitive data.V-255867MEDIUMThe WebSphere Application Server must provide security extensions to extend the SOAP protocol and provide secure authentication when accessing sensitive data.V-255868MEDIUMThe WebSphere Application Server must authenticate all network-connected endpoint devices before establishing any connection.V-255869MEDIUMThe WebSphere Application Server must authenticate all endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.V-255870HIGHThe WebSphere Application Server application security must be enabled for each security domain except for publicly available applications specified in the System Security Plan.V-255871HIGHThe WebSphere Application Server secure LDAP (LDAPS) must be used for authentication.V-255872MEDIUMThe WebSphere Application Server must prohibit the use of cached authenticators after an organization-defined time period.V-255873HIGHThe WebSphere Application Server default keystore passwords must be changed.V-255874MEDIUMThe WebSphere Application Server must use signer for DoD-issued certificates.V-255875MEDIUMThe WebSphere Application Server must utilize FIPS 140-2-approved encryption modules when authenticating users and processes.V-255876MEDIUMThe WebSphere Application Server must accept Personal Identity Verification (PIV) credentials from other federal agencies to access the management interface.V-255877MEDIUMThe WebSphere Application Server must use DoD-approved Signer Certificates.V-255878MEDIUMThe WebSphere Application Servers must not be in the DMZ.V-255879MEDIUMThe WebSphere Application Server DoD root CAs must be in the trust store.V-255880MEDIUMThe WebSphere Application Server personal certificates in all keystores must be issued by an approved DoD CA.V-255881LOWThe WebSphere Application Server must be configured to perform complete application deployments when using A/B clusters.V-255882LOWThe WebSphere Application servers with an RMF categorization of high must be in a high-availability (HA) cluster.V-255883LOWThe WebSphere Application Server must not generate LTPA keys automatically.V-255884LOWThe WebSphere Application Server must periodically regenerate LTPA keys.V-255885MEDIUMThe WebSphere Application Server high availability applications must be installed on a cluster.V-255886LOWThe WebSphere Application Server memory session settings must be defined according to application load requirements.V-255887MEDIUMThe WebSphere Application Server thread pool size must be defined according to application load requirements.V-255888MEDIUMThe WebSphere Application Server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.V-255889MEDIUMThe WebSphere Application Server distribution and consistency services (DCS) transport links must be encrypted.V-255890MEDIUMThe WebSphere Application Server plugin must be configured to use HTTPS only.V-255891MEDIUMThe WebSphere Application Server must remove organization-defined software components after updated versions have been installed.V-255892MEDIUMThe WebSphere Application Server must apply the latest security fixes.V-255893MEDIUMThe WebSphere Application Server must install security-relevant software updates within the time period directed by an authoritative source (e.g., IAVMs, CTOs, DTMs, and STIGs).V-283677MEDIUMThe WebSphere Application Server must use FIPS 140-3-approved encryption modules when authenticating users and processes.