The ALG must transmit only encrypted representations of passwords.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000400-ALG-000097	SRG-NET-000400-ALG-000097	SRG-NET-000400-ALG-000097_rule		Medium

Description
Passwords need to be protected at all times and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. This requirement applies to ALGs that provide user authentication proxy services (e.g., authentication gateway or TLS/SSL gateway). This does not apply to authentication for the purpose of configuring the device itself (device management).

Description

Passwords need to be protected at all times and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. This requirement applies to ALGs that provide user authentication proxy services (e.g., authentication gateway or TLS/SSL gateway). This does not apply to authentication for the purpose of configuring the device itself (device management).

STIG	Date
Application Layer Gateway Security Requirements Guide	2014-06-27

Details

Check Text ( C-SRG-NET-000400-ALG-000097_chk )
If the ALG does not provide user authentication proxy services, this is not a finding. Verify the ALG transmits only encrypted representations of passwords. If the ALG does not transmit only encrypted representations of passwords, this is a finding.

Fix Text (F-SRG-NET-000400-ALG-000097_fix)
Configure the ALG transmit only encrypted representations of passwords.