CCI-001453
Implement cryptographic mechanisms to protect the integrity of remote access sessions.
11 rules found Severity: Medium
7 rules found Severity: High
6 rules found Severity: Medium
7 rules found Severity: Medium
6 rules found Severity: Medium
Compliance Guardian must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.
1 rule found Severity: High
The CA API Gateway providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
1 rule found Severity: Medium
If the BlackBerry Connect service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to enable SSL support for BlackBerry Proxy and use only DoD approved certificates.
1 rule found Severity: Medium
If the BlackBerry Docs service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to use SSL for LDAP lookup to connect to the Office Web App Server (e.g., SharePoint).
2 rules found Severity: High
If the BlackBerry Connect service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to enable SSL support for BlackBerry Proxy and use only DOD approved certificates.
1 rule found Severity: Medium
1 rule found Severity: High
2 rules found Severity: High
1 rule found Severity: Medium
DoD-approved encryption must be implemented to protect the confidentiality and integrity of remote access sessions, information during preparation for transmission, information during reception, and information during transmission in addition to enforcing replay-resistant authentication mechanisms for network access to privileged accounts.
1 rule found Severity: High
The IBM Aspera Console must be configured to use NIST FIPS-validated cryptography to protect the integrity of file transfers.
1 rule found Severity: High
IBM Aspera Faspex must be configured to use NIST FIPS-validated cryptography to protect the integrity of file transfers.
1 rule found Severity: High
IBM Aspera Shares feature must be configured to use NIST FIPS-validated cryptography to protect the integrity of file transfers.
1 rule found Severity: High
The IBM Aspera High-Speed Transfer Endpoint must be configured to use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
1 rule found Severity: High
The IBM Aspera High-Speed Transfer Endpoint must have a master-key set to encrypt the dynamic token encryption key.
1 rule found Severity: Medium
The IBM Aspera High-Speed Transfer Server must be configured to use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
1 rule found Severity: High
The IBM Aspera High-Speed Transfer Server must have a master-key set to encrypt the dynamic token encryption key.
1 rule found Severity: Medium
The DataPower Gateway providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
1 rule found Severity: Medium
The MQ Appliance messaging server must implement cryptography mechanisms to protect the integrity of the remote access session.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
If cipher suites using pre-shared keys are used for device authentication, the ISEC7 EMM Suite must have a minimum security strength of 112 bits or higher, must only be used in networks where both the client and server are Government systems, must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0 and must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithm for transmission.
1 rule found Severity: Medium
The Sentry providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
2 rules found Severity: Medium
Nutanix AOS must implement DoD-approved encryption to protect the confidentiality of remote access sessions.
1 rule found Severity: High
Nutanix AOS must implement cryptography mechanisms to protect the confidentiality and integrity of the remote access session.
1 rule found Severity: High
OHS must have the LoadModule ossl_module directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.
1 rule found Severity: High
OHS must have the SSLFIPS directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.
1 rule found Severity: High
OHS must have the SSLEngine, SSLProtocol, and SSLWallet directives enabled and configured to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.
1 rule found Severity: High
OHS must have the SSLCipherSuite directive enabled to protect the integrity of remote sessions in accordance with the categorization of data hosted by the web server.
1 rule found Severity: High
OHS must have the SecureProxy directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.
1 rule found Severity: Medium
OHS must have the WLSSLWallet directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.
1 rule found Severity: Medium
OHS must have the WebLogicSSLVersion directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.
1 rule found Severity: Medium
OHS must have the WLProxySSL directive enabled to protect the integrity of remote sessions when integrated with WebLogic in accordance with the categorization of data hosted by the web server.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Riverbed Optimization System (RiOS) providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
1 rule found Severity: Medium
Innoslate must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.
1 rule found Severity: High
The Tanium endpoint must have the Tanium Servers public key in its installation, which will allow it to authenticate and uniquely identify all network-connected endpoint devices before establishing any connection.
1 rule found Severity: Medium
Content providers must provide their public key to the Tanium administrator to import for validating signed content.
5 rules found Severity: Medium
Tanium public keys of content providers must be validated against documented trusted content providers.
5 rules found Severity: Medium
1 rule found Severity: Medium
3 rules found Severity: Medium
1 rule found Severity: High
1 rule found Severity: High
The macOS system must implement approved ciphers within the SSH client configuration to protect the confidentiality of SSH connections.
2 rules found Severity: High
The macOS system must implement approved Message Authentication Codes (MACs) within the SSH client configuration.
2 rules found Severity: High
The macOS system must implement approved Key Exchange Algorithms within the SSH client configuration.
2 rules found Severity: High
The Ubuntu operating system must configure the SSH daemon to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms to protect the integrity of nonlocal maintenance and diagnostic communications.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications.
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.
2 rules found Severity: Medium
The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.
1 rule found Severity: Medium
The BIG-IP Core implementation must be configured to use NIST SP 800-52 Revision 1 compliant cryptography to protect the integrity of remote access sessions to virtual servers.
1 rule found Severity: Medium
The macOS system must implement approved ciphers within the SSH server configuration to protect the confidentiality of SSH connections.
1 rule found Severity: High
The macOS system must implement approved Message Authentication Codes (MACs) within the SSH server configuration.
1 rule found Severity: High
The macOS system must implement approved Key Exchange Algorithms within the SSH server configuration.
1 rule found Severity: High
The Ubuntu operating system must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
1 rule found Severity: Medium
The Cisco ASA remote access VPN server must be configured to use a FIPS-validated algorithm and hash function to protect the integrity of TLS remote access sessions.
1 rule found Severity: Medium
The Cisco ASA remote access VPN server must be configured to use SHA-2 at 384 bits or greater for hashing to protect the integrity of IPsec remote access sessions.
1 rule found Severity: Medium
The Enterprise Voice, Video, and Messaging Endpoint must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.
1 rule found Severity: High
The F5 BIG-IP appliance providing intermediary services for remote access must use FIPS-validated cryptographic algorithms, including TLS 1.2 at a minimum.
1 rule found Severity: High
The Enterprise Voice, Video, and Messaging Session Manager must be configured to use only TLS 1.2 or greater for all TLS and SSL communications.
1 rule found Severity: High
SSMC must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
1 rule found Severity: Medium
1 rule found Severity: High
The HPE 3PAR OS must be configured to restrict the encryption algorithms and protocols to comply with DOD-approved encryption to protect the confidentiality and integrity of remote access sessions.
1 rule found Severity: High
If LDAP authentication is required on AIX, SSL must be used between LDAP clients and the LDAP servers to protect the integrity of remote access sessions.
1 rule found Severity: Medium
Hardware Management Console management must be accomplished by using the out-of-band or direct connection method.
1 rule found Severity: Medium
If cipher suites using pre-shared keys are used for device authentication, the ISEC7 SPHERE must have a minimum security strength of 112 bits or higher, must only be used in networks where both the client and server are government systems, must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0 and must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithm for transmission.
1 rule found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications.
1 rule found Severity: Medium
The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.
2 rules found Severity: Medium
The Oracle Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.
1 rule found Severity: Medium
The Oracle Linux operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.
1 rule found Severity: Medium
Automation Controller must implement cryptography mechanisms to protect the integrity of information.
1 rule found Severity: High
1 rule found Severity: Medium
SLEM 5 must implement DOD-approved encryption to protect the confidentiality of SSH remote connections.
1 rule found Severity: High
SLEM 5 SSH server must be configured to use only FIPS 140-2/140-3 validated key exchange algorithms.
1 rule found Severity: High
1 rule found Severity: Medium
The TOSS operating system must implement DoD-approved encryption to protect the confidentiality of SSH connections.
1 rule found Severity: Medium
1 rule found Severity: Medium
The TOSS SSH daemon must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms.
1 rule found Severity: Medium
1 rule found Severity: Medium
NixOS must implement DOD-approved encryption to protect the confidentiality of remote access sessions.
1 rule found Severity: High
1 rule found Severity: Medium
The Apache web server must use encryption strength in accordance with the categorization of data hosted by the Apache web server when remote connections are provided.
2 rules found Severity: Medium
An Apache web server must maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.
1 rule found Severity: High
The ALG providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
1 rule found Severity: Medium
The application server must implement cryptography mechanisms to protect the integrity of the remote access session.
1 rule found Severity: Medium
The application must implement cryptographic mechanisms to protect the integrity of remote access sessions.
1 rule found Severity: Medium
Applications with SOAP messages requiring integrity must include the following message elements:-Message ID-Service Request-Timestamp-SAML Assertion (optionally included in messages) and all elements of the message must be digitally signed.
1 rule found Severity: Medium
Ubuntu 22.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3-approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
1 rule found Severity: Medium
AlmaLinux OS 9 SSH client must be configured to use only encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
1 rule found Severity: Medium
AlmaLinux OS 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH client connections.
1 rule found Severity: Medium
AlmaLinux OS 9 SSH client must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.
1 rule found Severity: Medium
AlmaLinux OS 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH server connections.
1 rule found Severity: Medium
AlmaLinux OS 9 SSH server must be configured to use only FIPS 140-3 validated key exchange algorithms.
1 rule found Severity: Medium
AlmaLinux OS 9 must implement DOD-approved systemwide cryptographic policies to protect the confidentiality of SSH server connections.
1 rule found Severity: Medium
AlmaLinux OS 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
The container platform must prohibit communication using TLS versions 1.0 and 1.1, and SSL 2.0 and 3.0.
1 rule found Severity: Medium
The operating system must implement cryptography to protect the integrity of remote access sessions.
1 rule found Severity: High
AOS, when used as a VPN Gateway, must be configured to use IPsec with SHA-2 at 384 bits or greater for hashing to protect the integrity of remote access sessions.
1 rule found Severity: Medium
AOS must use Transport Layer Security (TLS) 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.
1 rule found Severity: Medium
1 rule found Severity: High
IBM z/OS SSL encryption options for the TN3270 Telnet Server must be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.
2 rules found Severity: Medium
The IBM RACF SSH daemon must be configured to use a FIPS 140-2 compliant cryptographic algorithm to protect confidential information and remote access sessions.
1 rule found Severity: High
1 rule found Severity: High
IBM z/OS SSL encryption options for the TN3270 Telnet server must be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.
1 rule found Severity: Medium
The Juniper SRX Services Gateway VPN must be configured to use IPsec with SHA256 or greater to negotiate hashing to protect the integrity of remote access sessions.
1 rule found Severity: Medium
1 rule found Severity: High
Windows Server 2019 Remote Desktop Services must require secure Remote Procedure Call (RPC) communications.
1 rule found Severity: Medium
Windows Server 2019 Remote Desktop Services must be configured with the client connection encryption set to High Level.
1 rule found Severity: Medium
Windows Server 2022 Remote Desktop Services must require secure Remote Procedure Call (RPC) communications.
1 rule found Severity: Medium
Windows Server 2022 Remote Desktop Services must be configured with the client connection encryption set to High Level.
1 rule found Severity: Medium
OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Palo Alto Networks security platform, if used as a TLS gateway/decryption point or VPN concentrator, must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.
1 rule found Severity: Medium
Rancher RKE2 must protect authenticity of communications sessions with the use of FIPS-validated 140-2 or 140-3 security requirements for cryptographic modules.
1 rule found Severity: High
The RHEL 8 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms.
1 rule found Severity: Medium
The RHEL 8 operating system must implement DOD-approved encryption to protect the confidentiality of SSH server connections.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
RHEL 9 must implement DOD-approved encryption ciphers to protect the confidentiality of SSH connections.
1 rule found Severity: Medium
The RHEL 9 SSH server must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
1 rule found Severity: Medium
The RHEL 9 SSH server must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH server connections.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The RHEL 9 SSH client must be configured to use only DOD-approved encryption ciphers employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
1 rule found Severity: Medium
The RHEL 9 SSH client must be configured to use only DOD-approved Message Authentication Codes (MACs) employing FIPS 140-3 validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
1 rule found Severity: Medium
The SUSE operating system SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.
2 rules found Severity: Medium
The SUSE operating system SSH server must be configured to use only FIPS-validated key exchange algorithms.
2 rules found Severity: Medium
The boundary protection system (firewall) must be configured to deny network traffic by default and must allow network traffic by exception (i.e., deny all, permit by exception).
2 rules found Severity: Medium
The UEM server must be configured to prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Low
1 rule found Severity: Medium
The vCenter Server must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.
1 rule found Severity: High
The Photon operating system must implement only approved ciphers to protect the integrity of remote access sessions.
2 rules found Severity: High
The remote access VPN Gateway must use a digital signature generated using FIPS-validated algorithms and an approved hash function to protect the integrity of TLS remote access sessions.
1 rule found Severity: Medium
The VPN Gateway must be configured to use IPsec with SHA-2 at 384 bits or greater for hashing to protect the integrity of remote access sessions.
1 rule found Severity: Medium
The TLS VPN Gateway that supports Government-only services must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.
1 rule found Severity: Medium
The Photon operating system must implement only approved Message Authentication Codes (MACs) to protect the integrity of remote access sessions.
2 rules found Severity: High
1 rule found Severity: Medium
The TLS VPN Gateway that supports citizen- or business-facing network devices must prohibit client negotiation to SSL 2.0 or SSL 3.0.
1 rule found Severity: Medium
2 rules found Severity: Medium
The vCenter Server must use DOD-approved encryption to protect the confidentiality of network sessions.
1 rule found Severity: Medium