Free DISA STIG and SRG Library | Vaulted

V-65521

The ArcGIS Server must maintain a separate execution domain for each executing process.

Finding ID
AGIS-00-000197
Rule ID
SV-80011r1_rule
Severity
Cat II
CCE
(None)
Group Title
SRG-APP-000431
CCI
CCI-002530
Target Key
(None)
Documentable
No
Discussion

Applications can maintain separate execution domains for each executing process by assigning each process a separate address space. Each process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. An example is a web browser with process isolation that provides tabs that are separate processes using separate address spaces to prevent one tab crashing the entire browser. 

Fix Text

Configure the ArcGIS Server to ensure all published services maintain a separate execution domain for each process. Substitute the target environment’s values for [bracketed] variables. In PowerShell, run the following command, replacing the [bracketed] values with the path of the ArcGIS Server Site "config-store": Get-ChildItem -recurse [C:\arcgisserver\]config-store\services\*.json | Select-String -pattern "`"isolationLevel`": `"LOW`"" Stop ArcGIS Server, then replace the "LOW" with "HIGH" in all found files.

Check Content

Review the ArcGIS Server configuration to ensure all published services maintain a separate execution domain for each process. Substitute the target environment’s values for [bracketed] variables. In PowerShell, run the following command, replacing the [bracketed] values with the path of the ArcGIS Server Site "config-store": Get-ChildItem -recurse [C:\arcgisserver\]config-store\services\*.json | Select-String -pattern "`"isolationLevel`": `"LOW`"" If any values are returned, this is a finding.