CCI-000197
For password-based authentication, transmit passwords only cryptographically-protected channels.
The A10 Networks ADC must prohibit the use of unencrypted protocols for network access to privileged accounts.
1 rule found Severity: Medium
The CA API Gateway providing user authentication intermediary services must transmit only encrypted representations of passwords.
1 rule found Severity: Medium
If passwords are used for authentication, DB2 must transmit only encrypted representations of passwords.
1 rule found Severity: Medium
The IBM Aspera Console feature must be configured to use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.
1 rule found Severity: High
The IBM Aspera Faspex feature must be configured to use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.
1 rule found Severity: High
The IBM Aspera Shares feature must be configured to use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.
1 rule found Severity: High
1 rule found Severity: Medium
Access to the MQ Appliance messaging server must utilize encryption when using LDAP for authentication.
1 rule found Severity: Medium
1 rule found Severity: High
The WebSphere Application Server Single Sign On (SSO) must have SSL enabled for Web and SIP Security.
1 rule found Severity: High
The WebSphere Application Server application security must be enabled for each security domain except for publicly available applications specified in the System Security Plan.
1 rule found Severity: High
1 rule found Severity: High
CA VM:Secure product Password Encryption (PEF) option must be properly configured to store and transmit cryptographically-protected passwords.
1 rule found Severity: High
OHS must have the LoadModule ossl_module directive enabled to encrypt passwords during transmission.
1 rule found Severity: High
OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to encrypt passwords during transmission.
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: High
2 rules found Severity: High
If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords.
3 rules found Severity: High
If passwords are used for authentication, PostgreSQL must transmit only encrypted representations of passwords.
3 rules found Severity: High
The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use the SSHv2 protocol.
1 rule found Severity: High
If passwords are used for authentication, the EDB Postgres Advanced Server must transmit only encrypted representations of passwords.
2 rules found Severity: High
1 rule found Severity: Medium
For accounts using password authentication, the Cisco ISE must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
1 rule found Severity: High
The Enterprise Voice, Video, and Messaging Endpoint, when using passwords or PINs for authentication or authorization, must be configured to cryptographically protect the PIN or password.
1 rule found Severity: High
For accounts using password authentication, the Enterprise Voice, Video, and Messaging Session Manager must be configured to use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
1 rule found Severity: Medium
For accounts using password authentication, the F5 BIG-IP appliance site-to-site IPsec VPN Gateway must use SHA-2 or later protocol to protect the integrity of the password authentication process.
1 rule found Severity: High
SSMC web server must use encryption strength in accordance with the categorization of data hosted by the web server when remote connections are provided.
1 rule found Severity: High
The HPE 3PAR OS must be configured to restrict the encryption algorithms and protocols to comply with DOD-approved encryption to protect the confidentiality and integrity of remote access sessions.
1 rule found Severity: High
The HPE 3PAR OS CIMserver process must be configured to use approved encryption and communications protocols to protect the confidentiality of remote access sessions.
1 rule found Severity: High
The HPE 3PAR OS WSAPI process must be configured to use approved encryption and communications protocols to protect the confidentiality of remote access sessions.
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: High
AIX must disable /usr/bin/rcp, /usr/bin/rlogin, /usr/bin/rsh, /usr/bin/rexec and /usr/bin/telnet commands.
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: Medium
If passwords are used for authentication, the MarkLogic Server must transmit only encrypted representations of passwords.
1 rule found Severity: High
A private IIS 10.0 website authentication mechanism must use client certificates to transmit session identifier to assure integrity.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
The Oracle Linux operating system must be configured so that the SSH daemon is configured to only use the SSHv2 protocol.
1 rule found Severity: High
If passwords are used for authentication, the MySQL Database Server 8.0 must transmit only encrypted representations of passwords.
1 rule found Severity: High
The Riverbed NetProfiler must be configured to implement cryptographic mechanisms using a FIPS 140-2/140-3 validated algorithm to protect the confidentiality and integrity of all cryptographic functions.
1 rule found Severity: High
Automation Controller must use encryption strength in accordance with the categorization of the management data during remote access management sessions.
1 rule found Severity: Medium
1 rule found Severity: Medium
Splunk Enterprise must be installed in FIPS mode to implement NIST FIPS-approved cryptography for all cryptographic functions.
1 rule found Severity: High
The Solidcore client Command Line Interface (CLI) Access Password protection process must be documented in the organizations written policy.
1 rule found Severity: Medium
1 rule found Severity: Medium
AAA Services must be configured to encrypt transmitted credentials using a FIPS-validated cryptographic module.
1 rule found Severity: High
The Apache web server must use encryption strength in accordance with the categorization of data hosted by the Apache web server when remote connections are provided.
1 rule found Severity: Medium
An Apache web server must maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
The ALG providing user authentication intermediary services must transmit only encrypted representations of passwords.
1 rule found Severity: Medium
1 rule found Severity: High
For accounts using password authentication, the Central Log Server must use FIPS-validated SHA-1 or later protocol to protect the integrity of the password authentication process.
1 rule found Severity: High
1 rule found Severity: High
For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
1 rule found Severity: High
If passwords are used for authentication, the DBMS must transmit only encrypted representations of passwords.
1 rule found Severity: High
The Dell OS10 Switch must use FIPS 140-2 approved algorithms for authentication to a cryptographic module.
1 rule found Severity: High
1 rule found Severity: High
AOS, when used as an IPsec VPN Gateway, must use Advanced Encryption Standard (AES) encryption for the Internet Key Exchange (IKE) proposal to protect confidentiality of remote access sessions.
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: High
The Juniper SRX Services Gateway must use the SHA256 or later protocol for password authentication for local accounts using password authentication (i.e., the root account and the account of last resort).
1 rule found Severity: High
1 rule found Severity: Medium
If passwords are used for authentication, MariaDB must transmit only encrypted representations of passwords.
1 rule found Severity: High
If passwords are used for authentication, SQL Server must transmit only encrypted representations of passwords.
1 rule found Severity: High
Confidentiality of information during transmission is controlled through the use of an approved TLS version.
1 rule found Severity: High
Windows Server 2019 unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers.
1 rule found Severity: Medium
Windows Server 2022 unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers.
1 rule found Severity: Medium
The Palo Alto Networks security platform must prohibit the use of unencrypted protocols for network access to privileged accounts.
1 rule found Severity: Medium
1 rule found Severity: High
The SUSE operating system must not have the vsftpd package installed if not required for operational support.
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: Medium
The SUSE operating system must not have the vsftpd package installed if not required for operational support.
1 rule found Severity: Medium
The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).
2 rules found Severity: Medium
For UEM server using password authentication, the network element must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
2 rules found Severity: High
For accounts using password authentication, the site-to-site VPN Gateway must use SHA-2 or later protocol to protect the integrity of the password authentication process.
1 rule found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
Rancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
1 rule found Severity: High