documentation_complete: true

title: 'Configure Load Balancing (LB) or High Availability (HA)'

description: |-
    Configure the application server to provide LB or HA services for the hosted
    application.

rationale: |-
    A MAC I system is a system that handles data vital to the organization's
    operational readiness or effectiveness of deployed or contingency forces. A MAC
    I system must maintain the highest level of integrity and availability. By HA
    clustering the application server, the hosted application and data are given a
    platform that is load-balanced and provides high availability.

severity: medium

identifiers:
    cce: 80492-2

references:
    disa: 2385
    nist: ""
    srg: SRG-APP-000435-AS-000069
    stigid: JBOS-AS-000640

ocil_clause: 'it is not'

ocil: |-
    Interview the system admin and determine if the applications hosted on the
    application server are mission critical and require load balancing (LB) or high
    availability (HA).
    <br /><br />
    If the applications do not require LB or HA, this
    requirement is NA.
    <br /><br />
    If the documentation shows the LB or HA services are being
    provided by another system other than the application server, this requirement
    is NA.
    <br /><br />
    If applications require LB or HA, request documentation from the system
    admin that identifies what type of LB or HA configuration has been implemented
    on the application server.
    <br /><br />
    Ask the system admin to identify the components that
    require protection. Some options are included here as an example. Bear in mind
    the examples provided are not complete and absolute and are only provided as
    examples. The components being made redundant or HA by the application server
    will vary based upon application availability requirements.
    <br /><br />
    Examples are:
    Instances of the Application Server
    Web Applications
    Stateful, stateless and
    entity Enterprise Java Beans (EJBs)
    Single Sign On (SSO) mechanisms
    Distributed
    Cache
    HTTP sessions
    JMS and Message Services.
    <br /><br />
    If the hosted application
    requirements specify LB or HA and the JBoss server has not been configured to
    offer HA or LB, this is a finding.
