Applications involved in the production, control, and distribution of symmetric cryptographic keys must use NIST-approved or NSA-approved key management technology and processes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35608	SRG-APP-000192-AS-NA	SV-46895r1_rule		Medium

Description
Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. In addition to being required for the effective operation of a cryptographic mechanism, effective cryptographic key management provides protections to maintain the availability of the information in the event of the loss of cryptographic keys by users. This requirement applies solely to symmetric type cryptographic keys. An AS will more often than not utilize asymmetric type crypto keys however it is possible that an AS might rarely use a symmetric key. While this requirement could potentially apply, it was decided to utilize CCI-001140 as that requirement addresses both symmetric and asymmetric crypto keys.

Description

Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. In addition to being required for the effective operation of a cryptographic mechanism, effective cryptographic key management provides protections to maintain the availability of the information in the event of the loss of cryptographic keys by users. This requirement applies solely to symmetric type cryptographic keys. An AS will more often than not utilize asymmetric type crypto keys however it is possible that an AS might rarely use a symmetric key. While this requirement could potentially apply, it was decided to utilize CCI-001140 as that requirement addresses both symmetric and asymmetric crypto keys.

STIG	Date
Application Server Security Requirements Guide	2013-01-08

Details

Check Text ( C-43951r1_chk )
The requirement is NA for the AS SRG.

Fix Text (F-40149r1_fix)
The requirement is NA. No fix is required.