The DBMS must utilize DoD-approved encryption to protect the confidentiality of classified data passing over remote access sessions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-58043	SRG-APP-000014-DB-000311	SV-72473r1_rule		Medium

Description
Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Note that remote access as defined here may not mean exactly the same thing as remote access in the terminology of the DBMS. Encryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection, thereby providing a degree of confidentiality. The encryption strength of mechanism is selected based on the security categorization of the information. DoD-approved cryptography is as specified in the NIST publication FIPS PUB 140-2, "Security Requirements for Cryptographic Modules." Additionally, for classified systems, NSA Type-X (where X=1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules.

Description

Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Note that remote access as defined here may not mean exactly the same thing as remote access in the terminology of the DBMS. Encryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection, thereby providing a degree of confidentiality. The encryption strength of mechanism is selected based on the security categorization of the information. DoD-approved cryptography is as specified in the NIST publication FIPS PUB 140-2, "Security Requirements for Cryptographic Modules." Additionally, for classified systems, NSA Type-X (where X=1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules.

STIG	Date
Database Security Requirements Guide	2015-02-13

Details

Check Text ( C-58813r2_chk )
Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, this is not applicable (NA). Review DBMS settings to determine if the database is configured to accept remote connections. If the database is not configured to accept remote connections, this is not a finding. Check DBMS settings to determine whether the data for remote connections is being encrypted with DoD-approved cryptography. If data for remote connections is not being encrypted with DoD-approved cryptography, this is a finding.

Check Text ( C-58813r2_chk )

Review system documentation to determine whether the system handles classified information.

If the system does not handle classified information, this is not applicable (NA).

Review DBMS settings to determine if the database is configured to accept remote connections.

If the database is not configured to accept remote connections, this is not a finding.

Check DBMS settings to determine whether the data for remote connections is being encrypted with DoD-approved cryptography.

If data for remote connections is not being encrypted with DoD-approved cryptography, this is a finding.

Fix Text (F-63251r1_fix)
Configure the DBMS to encrypt data passing over remote connections using DoD-approved encryption appropriate to the sensitivity level.