STIGhubSTIGhub
STIGsRMF ControlsCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • RMF Controls
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 1 hour ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

ISEC7 Sphere Security Technical Implementation Guide

Version

V3R1

Release Date

Aug 20, 2024

SCAP Benchmark ID

ISEC7_Sphere

Total Checks

34

Tags

other
CAT I: 2CAT II: 31CAT III: 1

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (34)

V-224760MEDIUMThe ISEC7 SPHERE must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.V-224761MEDIUMThe ISEC7 SPHERE must initiate a session lock after a 15-minute period of inactivity.V-224762MEDIUMThe ISEC7 SPHERE must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.V-224763MEDIUMThe ISEC7 SPHERE must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the ISEC7 SPHERE.V-224764MEDIUMThe ISEC7 SPHERE server must be configured to have at least one user in the following Administrator roles: Security Administrator, Site Administrator, and Help Desk User.V-224765MEDIUMThe ISEC7 SPHERE must alert the information system security officer (ISSO) and system administrator (SA) (at a minimum) in the event of an audit processing failure.V-224766MEDIUMThe ISEC7 SPHERE must back up audit records at least every seven days onto a different system or system component than the system or component being audited, provide centralized management and configuration of the content to be captured in audit records generated by all ISEC7 SPHERE components, and offload audit records onto a different system or media than the system being audited.V-224767HIGHISEC7 SPHERE must disable or delete local account created during application installation and configuration.V-224768MEDIUMWhen using PKI-based authentication for user access, the ISEC7 SPHERE must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.V-224769LOWThe ISEC7 SPHERE must accept Personal Identity Verification (PIV) credentials.V-224770MEDIUMBefore establishing a local, remote, and/or network connection with any endpoint device, the ISEC7 SPHERE must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the device.V-224771MEDIUMThe ISEC7 SPHERE must allow the use of DOD PKI established certificate authorities for verification of the establishment of protected sessions.V-224772MEDIUMThe ISEC7 SPHERE must protect the confidentiality and integrity of transmitted information during preparation for transmission and during reception using cryptographic mechanisms.V-224773MEDIUMThe ISEC7 SPHERE must be configured to leverage the enterprise directory service accounts and groups for ISEC7 SPHERE server admin identification and authentication.V-224774MEDIUMThe ISEC7 SPHERE must configure the timeout for the console to be 15 minutes or less.V-224775MEDIUMThe ISEC7 SPHERE, Tomcat installation, and ISEC7 Suite monitor must be configured to use the Windows Trust Store for the storage of digital certificates and keys.V-224776MEDIUMIf cipher suites using pre-shared keys are used for device authentication, the ISEC7 SPHERE must have a minimum security strength of 112 bits or higher, must only be used in networks where both the client and server are government systems, must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0 and must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithm for transmission.V-224777MEDIUMThe ISEC7 SPHERE must use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification (nonlegacy use).V-224778MEDIUMThe ISEC7 SPHERE must use a FIPS-validated cryptographic module to provision digital signatures.V-224779MEDIUMThe ISEC7 SPHERE must use a FIPS 140-2-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality, generate cryptographic hashes, and to configure web management tools with FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to protect the confidentiality of maintenance and diagnostic communications for nonlocal maintenance sessions.V-224780MEDIUMThe Apache Tomcat Manager Web app password must be cryptographically hashed with a DOD-approved algorithm.V-224781MEDIUMAll Web applications included with Apache Tomcat that are not required must be removed.V-224782MEDIUMLockOutRealm must not be removed from Apache Tomcat.V-224783MEDIUMThe LockOutRealm must be configured with a login failure count of 3.V-224784MEDIUMThe LockOutRealm must be configured with a login lockout time of 15 minutes.V-224785MEDIUMThe Manager Web app password must be configured as follows: -15 or more characters. -at least one lower case letter. -at least one upper case letter. -at least one number. -at least one special character.V-224786MEDIUMThe ISEC7 SPHERE must configure Enable HTTPS to use HTTP over SSL in Apache Tomcat.V-224788MEDIUMStack tracing must be disabled in Apache Tomcat.V-224789MEDIUMThe Apache Tomcat shutdown port must be disabled.V-224790MEDIUMThe ISEC7 SPHERE must remove any unnecessary users or groups that have permissions to the server.xml file in Apache Tomcat.V-224791MEDIUMA manager role must be assigned to the Apache Tomcat Web apps (Manager, Host-Manager).V-224792MEDIUMSSL must be enabled on Apache Tomcat.V-224793MEDIUMTomcat SSL must be restricted except for ISEC7 SPHERE tasks.V-225096HIGHThe ISEC7 Sphere server must be maintained at a supported version.