The DBMS must utilize NIST FIPS 140-2 validated cryptographic modules to protect the integrity of remote access sessions in the unclassified environment.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32184	SRG-APP-000015-DB-000196	SV-42501r3_rule		Medium

Description
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Note that access via an approved and properly configured DoD Virtual Private Network (VPN) is deemed to be internal to the DoD Information Network (DoDIN) and so does not count as remote access. Note that remote access as defined here may not mean exactly the same thing as remote access in the terminology of the DBMS. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions. DoD-approved cryptography is as specified in the NIST publication FIPS PUB 140-2, "Security Requirements for Cryptographic Modules." Additionally, for classified systems, NSA Type-X (where X=1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules.

Description

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Note that access via an approved and properly configured DoD Virtual Private Network (VPN) is deemed to be internal to the DoD Information Network (DoDIN) and so does not count as remote access. Note that remote access as defined here may not mean exactly the same thing as remote access in the terminology of the DBMS. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions. DoD-approved cryptography is as specified in the NIST publication FIPS PUB 140-2, "Security Requirements for Cryptographic Modules." Additionally, for classified systems, NSA Type-X (where X=1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules.

STIG	Date
Database Security Requirements Guide	2015-12-21

Details

Check Text ( C-40689r7_chk )
Review system documentation to determine whether the system handles classified information. If the system handles classified information, this is not applicable (NA). Review DBMS settings to determine if the database is configured to accept remote connections. If the database is not configured to accept remote connections, this is not a finding. Check DBMS settings to determine whether the integrity of data over remote connections is being protected using NIST FIPS 140-2 validated cryptographic modules. If data integrity for remote connections is not so protected, this is a finding.

Check Text ( C-40689r7_chk )

Review system documentation to determine whether the system handles classified information. If the system handles classified information, this is not applicable (NA).

Review DBMS settings to determine if the database is configured to accept remote connections. If the database is not configured to accept remote connections, this is not a finding.

Check DBMS settings to determine whether the integrity of data over remote connections is being protected using NIST FIPS 140-2 validated cryptographic modules. If data integrity for remote connections is not so protected, this is a finding.

Fix Text (F-36108r3_fix)
Configure the DBMS to ensure integrity of data passing over remote connections using NIST FIPS 140-2 validated cryptographic modules.