CCI-001967
Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
The Arista Multilayer Switch must authenticate all endpoint devices before establishing a network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: Medium
1 rule found Severity: Medium
The CA API Gateway must authenticate NTP endpoint devices before establishing a network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: Low
The CA API Gateway must authenticate SNMP endpoint devices before establishing a network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: Medium
The CA API Gateway must authenticate RADIUS endpoint devices before establishing a network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: Medium
The CA API Gateway must authenticate LDAPS endpoint devices before establishing a network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: Medium
The CA API Gateway must obtain LDAPS server certificates securely to use bidirectional authentication that is cryptographically based.
1 rule found Severity: Medium
The FortiGate device must authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1 rule found Severity: Medium
The FortiGate device must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
1 rule found Severity: Medium
CounterACT must authenticate any endpoint used for network management before establishing a local, remote, and/or network connection using cryptographically based bidirectional authentication.
1 rule found Severity: Medium
CounterACT must authenticate SNMPv3 endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: High
The HYCU server must authenticate Network Time Protocol sources using authentication that is cryptographically based.
1 rule found Severity: Medium
The Infoblox DNS server must authenticate another DNS server before establishing a remote and/or network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: Medium
The MQ Appliance messaging server must authenticate all endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: High
The WebSphere Application Server must authenticate all endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: Medium
The DNS server implementation must authenticate another DNS server before establishing a remote and/or network connection using bidirectional authentication that is cryptographically based.
2 rules found Severity: Medium
The MobileIron Sentry must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1 rule found Severity: Medium
Before establishing a local, remote, and/or network connection with any endpoint device, the ISEC7 EMM Suite must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the device.
1 rule found Severity: Medium
If cipher suites using pre-shared keys are used for device authentication, the ISEC7 EMM Suite must have a minimum security strength of 112 bits or higher, must only be used in networks where both the client and server are Government systems, must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0 and must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithm for transmission.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Riverbed Optimization System (RiOS) must authenticate network management endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: Medium
Riverbed Optimization System (RiOS) must authenticate SNMP server before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: Medium
Riverbed Optimization System (RiOS) must authenticate NTP server before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: Medium
The SEL-2740S must authenticate Network Time Protocol sources using authentication that is cryptographically based.
1 rule found Severity: Medium
The Tanium Server must protect the confidentiality and integrity of transmitted information with cryptographic signing capabilities enabled to ensure the authenticity of communications sessions when making requests from Tanium Clients.
1 rule found Severity: Medium
Symantec ProxySG must configure SNMPv3 so that cryptographically-based bidirectional authentication is used.
1 rule found Severity: Medium
The Tanium cryptographic signing capabilities must be enabled on the Tanium Clients to safeguard the authenticity of communications sessions when answering requests from the Tanium Server.
1 rule found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Low
The network device must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
5 rules found Severity: Medium
The network device must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
4 rules found Severity: Medium
3 rules found Severity: Medium
The Arista network device must be configured to synchronize internal system clocks using redundant authenticated time sources.
1 rule found Severity: Medium
The Arista network device must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1 rule found Severity: Medium
The BIND 9.x server implementation must uniquely identify and authenticate the other DNS server before responding to a server-to-server transaction, zone transfer and/or dynamic update request using cryptographically based bidirectional authentication to protect the integrity of the information in transit.
1 rule found Severity: High
The Cisco ASA must be configured to authenticate Simple Network Management Protocol (SNMP) messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1 rule found Severity: Medium
The Cisco ASA must be configured to encrypt Simple Network Management Protocol (SNMP) messages using a FIPS 140-2 approved algorithm.
1 rule found Severity: Medium
The Cisco ASA must be configured to authenticate Network Time Protocol sources using authentication that is cryptographically based.
1 rule found Severity: Medium
The Cisco switch must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
3 rules found Severity: Medium
The Cisco switch must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
3 rules found Severity: Medium
The Cisco router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
3 rules found Severity: Medium
The Cisco router must be configured to authenticate NTP sources using authentication that is cryptographically based.
1 rule found Severity: Medium
Before establishing a connection with a Network Time Protocol (NTP) server, the Cisco ISE must authenticate using a bidirectional, cryptographically based authentication method that uses a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the NTP server. This is required for compliance with C2C Step 1.
1 rule found Severity: Medium
Before establishing a local, remote, and/or network connection with any endpoint device, the Cisco ISE must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the endpoint device. This is required for compliance with C2C Step 1.
1 rule found Severity: Medium
The Cisco ISE must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1 rule found Severity: Medium
The Cisco ISE must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
1 rule found Severity: Medium
The F5 BIG-IP appliance must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
1 rule found Severity: Medium
Before establishing a local, remote, and/or network connection with any endpoint device, the ISEC7 SPHERE must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the device.
1 rule found Severity: Medium
If cipher suites using pre-shared keys are used for device authentication, the ISEC7 SPHERE must have a minimum security strength of 112 bits or higher, must only be used in networks where both the client and server are government systems, must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0 and must prohibit or restrict the use of protocols that transmit unencrypted authentication information or use flawed cryptographic algorithm for transmission.
1 rule found Severity: Medium
If SNMP is used, the ICS must be configured to use SNMPv3 with FIPS-140-2/3 validated Keyed-Hash Message Authentication Code (HMAC).
1 rule found Severity: Medium
The ICS must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
1 rule found Severity: Medium
The ICS that provides a Simple Network Management Protocol (SNMP) Network Management System (NMS) must configure SNMPv3 to use FIPS-validated AES cipher block algorithm.
1 rule found Severity: Medium
The Sentry must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1 rule found Severity: Medium
The Juniper EX switch must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1 rule found Severity: High
The Juniper EX switch must use an an NTP service that is hosted by a trusted source or a DOD-compliant enterprise or local NTP server.
1 rule found Severity: Low
2 rules found Severity: Medium
Unauthenticated Remote Procedure Call (RPC) clients must be restricted from connecting to the RPC server.
1 rule found Severity: Medium
The network device must authenticate Network Time Protocol sources using authentication that is cryptographically based.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The Riverbed NetProfiler must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1 rule found Severity: Medium
The Riverbed NetProfiler must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
1 rule found Severity: Medium
The Tanium application must authenticate endpoint devices (servers) before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: Medium
The TippingPoint SMS must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1 rule found Severity: High
The TippingPoint SMS must authenticate Network Time Protocol sources using authentication that is cryptographically based.
1 rule found Severity: High
Service-Oriented Applications handling non-releasable data must authenticate endpoint devices via mutual SSL/TLS.
1 rule found Severity: Medium
The Cisco router must be configured to authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
2 rules found Severity: Medium
Before establishing a network connection with a Network Time Protocol (NTP) server, Dragos Platform must authenticate using a bidirectional, cryptographically based authentication method that uses a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the NTP server.
1 rule found Severity: Medium
The Dell OS10 Switch must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1 rule found Severity: Medium
The Dell OS10 Switch must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
1 rule found Severity: Medium
Forescout must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the endpoint device. This is required for compliance with C2C Step 1.
1 rule found Severity: Medium
Forescout must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1 rule found Severity: High
Before establishing a connection with a Network Time Protocol (NTP) server, Forescout must authenticate using a bidirectional, cryptographically based authentication method that uses a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the NTP server.
1 rule found Severity: Medium
AOS must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1 rule found Severity: Medium
AOS must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
1 rule found Severity: Medium
The operating system must authenticate all endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: Medium
The network element must protect wireless access to the system using Federal Information Processing Standard (FIPS)-validated Advanced Encryption Standard (AES) block cipher algorithms with an approved confidentiality mode.
1 rule found Severity: Medium
The Juniper router must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
1 rule found Severity: Medium
The Juniper router must be configured to authenticate NTP sources using authentication that is cryptographically based.
1 rule found Severity: Medium
1 rule found Severity: High
The Exchange client authentication with Exchange servers must be enabled to use Kerberos Password Authentication.
1 rule found Severity: Medium
Outlook must use remote procedure call (RPC) encryption to communicate with Microsoft Exchange servers.
1 rule found Severity: Medium
Windows Server 2019 must restrict unauthenticated Remote Procedure Call (RPC) clients from connecting to the RPC server on domain-joined member servers and standalone or nondomain-joined systems.
1 rule found Severity: Medium
1 rule found Severity: Medium
Windows Server 2022 must restrict unauthenticated Remote Procedure Call (RPC) clients from connecting to the RPC server on domain-joined member servers and standalone or nondomain-joined systems.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
Before establishing a connection to any endpoint device being managed, the UEM server must establish a trusted path between the server and endpoint that provides assured identification of the end point using a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the device.
1 rule found Severity: High
The UEM server must authenticate endpoint devices (servers) before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: Medium
If cipher suites using pre-shared keys are used for device authentication, the UEM server must have a minimum security strength of 112 bits or higher.
1 rule found Severity: Medium
The VMM must authenticate all endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
1 rule found Severity: Medium
The ESXi host must enable bidirectional Challenge-Handshake Authentication Protocol (CHAP) authentication for Internet Small Computer Systems Interface (iSCSI) traffic.
2 rules found Severity: Medium
3 rules found Severity: Medium