Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-35090 | SRG-APP-000015-AS-000010 | SV-46377r1_rule | Medium |
Description |
---|
Encryption is critical for protection of remote access sessions. If encryption is not being used for integrity, malicious users may gain the ability to modify the AS configuration. The use of cryptography for ensuring integrity of remote access sessions mitigates that risk. Application servers utilize a web management interface and scripted commands when allowing remote access. Web access requires the use of SSL 3.0 or TLS 1.0 and scripted access requires using ssh or some other form of approved cryptography. Application servers must have a capability to enable a secure remote admin capability. |
STIG | Date |
---|---|
Application Server Security Requirements Guide | 2013-01-08 |
Check Text ( C-43477r3_chk ) |
---|
Review the AS documentation and configuration to ensure the AS is configured to use cryptography to protect the integrity of remote access sessions. If the AS is not configured to use cryptography to protect the integrity of remote access sessions, this is a finding. |
Fix Text (F-39641r3_fix) |
---|
Configure the AS to utilize encryption during remote access sessions. |