The ALG providing authentication proxy connections must electronically verify Personal Identity Verification (PIV) credentials from other federal agencies.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| SRG-NET-000347-ALG-0000104 | SRG-NET-000347-ALG-0000104 | SRG-NET-000347-ALG-0000104_rule | Medium |
| Description |
|---|
| Inappropriate access may be granted to unauthorized users if federal agency PIV credentials are not electronically verified. PIV credentials are those credentials issued by federal agencies that conform to FIPS Publication 201 and supporting guidance documents. OMB Memorandum 11-11 requires federal agencies to continue implementing the requirements specified in HSPD-12 to enable agency-wide use of PIV credentials. This requirement applies to ALGs that provide user authentication proxy services (e.g., authentication gateway or TLS/SSL gateway). This does not apply to authentication for the purpose of configuring the device itself (device management). |
| STIG | Date |
|---|---|
| Application Layer Gateway Security Requirements Guide | 2014-06-27 |
Details
| Check Text ( C-SRG-NET-000347-ALG-0000104_chk ) |
|---|
| If the ALG does not provide user authentication proxy services, this is not a finding. Verify the ALG electronically verifies Personal Identity Verification (PIV) credentials from other federal agencies. If the ALG does not electronically verify Personal Identity Verification (PIV) credentials from other federal agencies, this is a finding. |
| Fix Text (F-SRG-NET-000347-ALG-0000104_fix) |
|---|
| Configure ALG to electronically verify Personal Identity Verification (PIV) credentials from other federal agencies. |