IBM WebSphere Liberty Server Security Technical Implementation Guide


This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: [email protected]


Version / Release: V1R1

Published: 2021-08-30

Updated At: 2021-11-06 12:48:00




Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-250322r795019_rule IBMW-LS-000010 CCI-000054 MEDIUM Maximum in-memory session count must be set according to application requirements. Application management includes the ability to control the number of sessions that use an application by all accounts and/or account types. Limiting the number of allowed sessions is helpful in limiting risks related to Denial of Service attacks. Applica
    SV-250323r795022_rule IBMW-LS-000020 CCI-000068 MEDIUM The WebSphere Liberty Server Quality of Protection (QoP) must be set to use TLSv1.2 or higher. Quality of Protection in WebSphere Liberty specifies the security level, ciphers, and mutual authentication settings for the Secure Socket Layer (SSL/TLS) configuration. For Quality of Protection settings to apply, the security feature (appSecurity-3.0) m
    SV-250324r795110_rule IBMW-LS-000030 CCI-001453 MEDIUM Security cookies must be set to HTTPOnly. Web applications use cookies to track users across requests. These cookies, while typically not sensitive in themselves, connect to the existing state on the back-end system. If an intruder were to capture one of these cookies, they could potentially use
    SV-250325r795028_rule IBMW-LS-000040 CCI-000067 MEDIUM The WebSphere Liberty Server must log remote session and security activity. Security auditing must be configured in order to log remote session activity. Security auditing will not be performed unless the audit feature (audit-1.0) has been enabled. The security feature (appSecurity-3.0) must be enabled for the security auditing t
    SV-250326r795031_rule IBMW-LS-000050 CCI-000213 HIGH Users in the REST API admin role must be authorized. Users with console access and OS permissions to the folders where the Liberty Server is installed can make changes to the server. In addition, REST API calls that execute server management tasks are available and can be executed remotely. Adding a user to
    SV-250327r795034_rule IBMW-LS-000230 CCI-000140 MEDIUM The WebSphere Liberty Server must be configured to offload logs to a centralized system. Log processing failures include, but are not limited to, failures in the application server log capturing mechanisms or log storage capacity being reached or exceeded. In some instances, it is preferred to send alarms to individuals rather than to an enti
    SV-250328r795037_rule IBMW-LS-000260 CCI-000163 MEDIUM The WebSphere Liberty Server must protect log information from unauthorized access or changes. WebSphere Liberty provides the capability to encrypt and sign the log data to prevent unauthorized modification. - The security feature (appSecurity-3.0) must be defined in order to configure a user registry for the servlet to authenticate against. -
    SV-250329r795040_rule IBMW-LS-000280 CCI-001493 MEDIUM The WebSphere Liberty Server must protect log tools from unauthorized access. Protecting log data also includes identifying and protecting the tools used to view and manipulate log data. Depending on the log format and application, system and application log tools may provide the only means to manipulate and manage application and
    SV-250330r795108_rule IBMW-LS-000320 CCI-000162 MEDIUM The WebSphere Liberty Server must be configured to encrypt log information. Protection of log records is of critical importance. Encrypting log records provides a level of protection that does not rely on host-based protections that can be accidentally misconfigured, such as file system permissions. Cryptographic mechanisms are t
    SV-250331r795046_rule IBMW-LS-000340 CCI-001499 MEDIUM The WebSphere Liberty Server must protect software libraries from unauthorized access. Application servers have the ability to specify that the hosted applications use shared libraries. The application server must have a capability to divide roles based upon duties wherein one project user (such as a developer) cannot modify the shared libr
    SV-250332r795049_rule IBMW-LS-000370 CCI-000382 MEDIUM The WebSphere Liberty Server must prohibit or restrict the use of nonsecure ports, protocols, modules, and/or services as defined in the PPSM CAL and vulnerability assessments. Some networking protocols may not meet organizational security requirements to protect data and components. Application servers natively host a number of various features, such as management interfaces, httpd servers, and message queues. These features a
    SV-250333r795052_rule IBMW-LS-000380 CCI-000764 MEDIUM The WebSphere Liberty Server must use an LDAP user registry. To ensure accountability and prevent unauthorized access, application server users must be uniquely identified and authenticated. This is typically accomplished via the use of a user store which is either local (OS-based) or centralized (LDAP) in nature.
    SV-250334r795055_rule IBMW-LS-000381 CCI-000764 MEDIUM Basic Authentication must be disabled. Basic authentication does not use a centralized user store like LDAP. Not using a centralized user store complicates user management tasks and increases the risk that user accounts could remain on the system long after users have moved to their next deplo
    SV-250335r795058_rule IBMW-LS-000390 CCI-000187 HIGH Multifactor authentication for network access to privileged accounts must be used. Multifactor authentication creates a layered defense and makes it more difficult for an unauthorized person to access the application server. If one factor is compromised or broken, the attacker still has at least one more barrier to breach before success
    SV-250336r795061_rule IBMW-LS-000440 CCI-000196 HIGH The WebSphere Liberty Server must store only encrypted representations of user passwords. WebSphere Liberty can either provide a local account store or integrate with enterprise account stores such as LDAP directories. If the application server stores application passwords in the server.xml configuration files, the application server must stor
    SV-250337r795064_rule IBMW-LS-000450 CCI-000197 HIGH The WebSphere Liberty Server must use TLS-enabled LDAP. Passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Application servers have
    SV-250338r795106_rule IBMW-LS-000500 CCI-000187 MEDIUM The WebSphere Liberty Server must use DoD-issued/signed certificates. The cornerstone of PKI is the private key used to encrypt or digitally sign information. The key by itself is a cryptographic value that does not contain specific user information, but the key can be mapped to a user. Without mapping the certificate used
    SV-250339r795070_rule IBMW-LS-000520 CCI-000803 HIGH The WebSphere Liberty Server must use FIPS 140-2 approved encryption modules when authenticating users and processes. Application servers must use and meet requirements of the DoD Enterprise PKI infrastructure for application authentication. Encryption is only as good as the encryption modules used. Unapproved cryptographic module algorithms cannot be verified and cannot
    SV-250340r795073_rule IBMW-LS-000720 CCI-002038 MEDIUM HTTP session timeout must be configured. An attacker can take advantage of user sessions that are left open, thus bypassing the user authentication process. To thwart the vulnerability of open and unused user sessions, the application server must be configured to close the sessions when a confi
    SV-250341r795076_rule IBMW-LS-000770 CCI-000068 HIGH Application security must be enabled on the WebSphere Liberty Server. Application security enables security for the applications in the environment. This type of security provides application isolation and requirements for authenticating application users. When a user enables security, both administrative and application se
    SV-250342r795079_rule IBMW-LS-000790 CCI-002235 MEDIUM Users in a reader-role must be authorized. The reader role is a management role that allows read-only access to select administrative REST APIs as well as the Admin Center UI (adminCenter-1.0). Preventing non-privileged users from viewing privileged functions mitigates the risk that unauthorized i
    SV-250343r795113_rule IBMW-LS-000830 CCI-001849 MEDIUM The WebSphere Liberty Server must allocate JVM log record storage capacity in accordance with organization-defined log record storage requirements. JVM logs are logs used to store application and runtime related events, rather than audit related events. They are mainly used to diagnose application or runtime bugs. However, they are useful for providing more context when correlated with audit related
    SV-250344r795085_rule IBMW-LS-000910 CCI-001813 MEDIUM The server.xml file must be protected from unauthorized modification. When dealing with access restrictions pertaining to change control, it should be noted that any changes to the software, and/or application server configuration could potentially have significant adverse effects on the overall security of the system. Pro
    SV-250345r795088_rule IBMW-LS-000970 CCI-002007 MEDIUM The WebSphere Liberty Server must prohibit the use of cached authenticators after an organization-defined time period. Larger authentication cache timeout values can increase security risks. For example, a user who is revoked can still log in by using a credential that is cached in the authentication cache until the cache is refreshed. Smaller authentication cache timeou
    SV-250346r795114_rule IBMW-LS-001050 CCI-002475 MEDIUM The WebSphere Liberty Server LTPA keys password must be changed. The default location of the automatically generated Lightweight Third Party Authentication (LTPA) keys file is ${server.output.dir}/resources/security/ltpa.keys. The LTPA keys are encrypted with a randomly generated key and a default password of WebAS i
    SV-250347r795094_rule IBMW-LS-001110 CCI-002418 MEDIUM The WebSphere Liberty Server must remove all export ciphers to protect the confidentiality and integrity of transmitted information. Export grade encryption suites are not strong and do not meet DoD requirements. The encryption for the session becomes easy for the attacker to break. Do not use export grade encryption.
    SV-250348r795097_rule IBMW-LS-001120 CCI-002421 MEDIUM The WebSphere Liberty Server must be configured to use HTTPS only. Transmission of data can take place between the application server and a large number of devices/applications external to the application server. Examples are a web client used by a user, a backend database, a log server, or other application servers in a
    SV-250349r795100_rule IBMW-LS-001170 CCI-002605 MEDIUM The WebSphere Liberty Server must install security-relevant software updates within the time period directed by an authoritative source. Security vulnerabilities are often addressed by testing and applying the latest security patches and fix packs. The latest fixpacks can be found at:
    SV-250350r795103_rule IBMW-LS-001190 CCI-000172 MEDIUM The WebSphere Liberty Server must generate log records for authentication and authorization events. Enabling authentication (SECURITY_AUTHN) and authorization (SECURITY_AUTHZ) event handlers configures the server to record security authorization and authentication events. By logging these events, the logs can be analyzed to identify activity that could