The ISEC7 EMM Suite must allow the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions.

An XCCDF Rule

Description

<VulnDiscussion>Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoD-approved CA, trust of this CA has not been established. The DoD will only accept PKI certificates obtained from a DoD-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of TLS certificates. This requirement focuses on communications protection for the application session rather than for the network packet. This requirement applies to applications that utilize communications sessions. This includes, but is not limited to, web-based applications and Service-Oriented Architectures (SOA).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-224771r505933_rule
Severity: Medium
References: CCI-002470
Updated: about 1 year ago

Submit a CSR for a DoD Issued Certificate with the private key.
Retrieve the approved certificate from the issuing Certificate Authority.
Set the friendly name on the certificate to https.

Windows-MY:
    Open the Microsoft Management Console.    Add the Certificates Snap-In for the ISEC7 Service Account.
    Navigate to the Personal Certificates Store.
    Import the certificate with Private key.
    Log in to the ISEC7 EMM Console.
    Navigate to Administration >> Configuration >> Apache Tomcat Settings.
    Set the Keystore Type to Windows-MY.

JavaKeystore:
    Using a Keystore browser such as Portecle, open the ISEC7 EMM Suite keystore.
    Enter the Keystore password when prompted.
    Delete the self-signed certificate in the keystore.
    Import the DoD issued certificate with the private key.
    Enter the key password when prompted.
    Enter the certificate alias as https when prompted.
    Save the keystore with the same keystore password.
    Log in to the ISEC7 EMM Console.
    Navigate to Administration >> Configuration >> Apache Tomcat Settings.
    Verify the Keystore type is set to JavaKeystore PKCS12.

The ISEC7 EMM Suite must allow the use of DoD PKI established certificate authorities for verification of the establishment of protected sessions.

Description

Remediation - Manual Procedure