The container platform must use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-233289	SRG-APP-000635-CTR-001405	SV-233289r601356_rule		High

Description
Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard. Cryptographic module used must have one FIPS-validated encryption algorithm (i.e., validated Advanced Encryption Standard [AES]). This validated algorithm must be used for encryption for cryptographic security function within the container platform component and information residing in the container platform registry and keystore.

Description

Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard. Cryptographic module used must have one FIPS-validated encryption algorithm (i.e., validated Advanced Encryption Standard [AES]). This validated algorithm must be used for encryption for cryptographic security function within the container platform component and information residing in the container platform registry and keystore.

STIG	Date
Container Platform Security Requirements Guide	2021-12-14

Details

Check Text ( C-36225r601354_chk )
Review the container platform configuration to ensure FIPS-validated cryptographic modules are implemented to encrypt unclassified information requiring confidentiality. If FIPS-validated cryptographic modules are not being used, this is a finding.

Fix Text (F-36193r601355_fix)
Configure the container platform to use FIPS-validated cryptographic modules to encrypt unclassified information requiring confidentiality.