Adobe ColdFusion STIG Checklist

19 items · Security · Hard difficulty · 3 hours

Practical STIG checklist to secure Adobe ColdFusion on Windows Server.

• Download latest Adobe ColdFusion STIG

  Obtain Ver 1, Rel 1 from DoD Cyber Exchange or public.cyber.mil.

• Inventory ColdFusion components and versions

  List ColdFusion, Tomcat, JVM, OS, and installed modules.

• Apply ColdFusion product patches and hotfixes

  Install vendor patches and security hotfixes per release notes.

• Update Java Virtual Machine and configure secure startup arguments

  Use a supported, patched JVM and document startup flags.

• Set JVM memory management startup arguments

  Tune Xms/Xmx and GC settings to match workload and stability needs.

• Configure JVM cryptographic and secure settings

  Enable secure crypto providers and restrict insecure algorithms.

• Harden Apache Tomcat configuration

  Remove default apps, restrict manager/host-manager, and secure connectors.

• Enforce TLS 1.2+ and strong cipher suites

  Disable SSLv3/TLS1.0/1.1 and prefer strong ciphers and secure protocols.

• Disable or restrict ColdFusion Administrator access

  Limit Admin to allowed IPs, use strong auth, and audit admin logins.

• Integrate ColdFusion logging with SIEM and centralize logs

  Forward application, system, and audit logs to your SIEM for alerts.

• Configure LDAP/IdP authentication and enforce least-privilege roles

  Map ColdFusion roles to LDAP groups and enforce role-based access.

• Set secure file and directory permissions for ColdFusion

  Restrict write/execute access to service accounts only.

• Disable unused ColdFusion services and connectors

  Turn off features and connectors not required by your deployment.

• Enable session timeout and secure cookie flags

  Set reasonable session lifetimes and mark cookies Secure and HttpOnly.

• Enable request validation and XSS/CSRF protections

  Activate built-in input validation and anti-CSRF measures for apps.

• Backup ColdFusion configuration and application files

  Create and secure backups of cfconfig, webapps, and data before changes.

• Perform a vulnerability scan and remediate findings

  Run authenticated scans and fix high/critical issues promptly.

• Restart ColdFusion service and verify application functionality

  Gracefully restart and run smoke tests to confirm uptime and features.

• Document changes and schedule periodic STIG reviews

  Record configurations, rationales, and set review cadence per policy.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.