Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
SRG-NET-000063-FW-000045 | SRG-NET-000063-FW-000045 | SRG-NET-000063-FW-000045_rule | High |
Description |
---|
Remote access services enable users outside of the enclave (external interface) to have access to data and services within the private network. In many instances these connections traverse the Internet. Remote access sessions must use encryption to protect the integrity of information traveling through a public network, such as the Internet. Requiring remote access sessions to the enclave to traverse an encrypted tunnel makes it difficult to alter the session content. |
STIG | Date |
---|---|
Firewall Security Requirements Guide | 2012-12-10 |
Check Text ( C-SRG-NET-000063-FW-000045_chk ) |
---|
Examine all Internet Security Association and Key Management Protocol (ISAKMP) and IPSec policies configured on the firewall. Determine what encryption algorithm is used for Internet Key Exchange (IKE) and IPSec cryptographic hashing operations. If an approved cryptography such as SHA is not used to protect the integrity of remote access sessions, this is a finding. |
Fix Text (F-SRG-NET-000063-FW-000045_fix) |
---|
Configure all ISAKMP and IPSec policies to use SHA for IKE and IPSec cryptographic hashing operations to protect the integrity of remote access sessions. |