The DBMS must utilize NIST FIPS 140-2 validated cryptographic modules for encryption of unclassified data passing over remote access sessions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32183	SRG-APP-000014-DB-000036	SV-42500r3_rule		Medium

Description
Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Note that access via an approved and properly configured DoD Virtual Private Network (VPN) is deemed to be internal to the DoD Information Network (DoDIN) and so does not count as remote access. Note that remote access as defined here may not mean exactly the same thing as remote access in the terminology of the DBMS. Encryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection, thereby providing a degree of confidentiality. The encryption strength of mechanism is selected based on the security categorization of the information. DoD-approved cryptography is as specified in the NIST publication FIPS PUB 140-2, "Security Requirements for Cryptographic Modules." Additionally, for classified systems, NSA Type-X (where X=1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules.

Description

Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Note that access via an approved and properly configured DoD Virtual Private Network (VPN) is deemed to be internal to the DoD Information Network (DoDIN) and so does not count as remote access. Note that remote access as defined here may not mean exactly the same thing as remote access in the terminology of the DBMS. Encryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection, thereby providing a degree of confidentiality. The encryption strength of mechanism is selected based on the security categorization of the information. DoD-approved cryptography is as specified in the NIST publication FIPS PUB 140-2, "Security Requirements for Cryptographic Modules." Additionally, for classified systems, NSA Type-X (where X=1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules.

STIG	Date
Database Security Requirements Guide	2015-02-13

Details

Check Text ( C-40688r7_chk )
Review system documentation to determine whether the system handles classified information. If the system handles classified information, this is not applicable (NA). Review DBMS settings to determine if the database is configured to accept remote connections. If the database is not configured to accept remote connections, this is not a finding. Check DBMS settings to determine whether the data for remote connections is being encrypted using NIST FIPS 140-2 validated cryptographic modules. If data for remote connections is not being encrypted with DoD-approved cryptography, this is a finding.

Check Text ( C-40688r7_chk )

Review system documentation to determine whether the system handles classified information. If the system handles classified information, this is not applicable (NA).

Review DBMS settings to determine if the database is configured to accept remote connections. If the database is not configured to accept remote connections, this is not a finding.

Check DBMS settings to determine whether the data for remote connections is being encrypted using NIST FIPS 140-2 validated cryptographic modules. If data for remote connections is not being encrypted with DoD-approved cryptography, this is a finding.

Fix Text (F-36107r5_fix)
Configure the DBMS to encrypt data passing over remote connections using NIST FIPS 140-2 validated cryptographic modules.