The firewall implementation must employ FIPS-validated cryptography to protect unclassified information.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000220-FW-000138	SRG-NET-000220-FW-000138	SRG-NET-000220-FW-000138_rule		Medium

Description
Cryptography is only as strong as the encryption modules/algorithms that are employed to encrypt the data. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Hence, it is imperative that transmission of data requiring privacy use FIPS 140-2 validated cryptography. The most common vulnerabilities with cryptographic modules are those associated with poor implementation. FIPS validation provides assurance that the relevant cryptography has been implemented correctly. This requirement applies where cryptography is required by the data owner or organizational policy to protect data in transit to or from the firewall or to protect data in storage on the firewall.

Description

Cryptography is only as strong as the encryption modules/algorithms that are employed to encrypt the data. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Hence, it is imperative that transmission of data requiring privacy use FIPS 140-2 validated cryptography. The most common vulnerabilities with cryptographic modules are those associated with poor implementation. FIPS validation provides assurance that the relevant cryptography has been implemented correctly. This requirement applies where cryptography is required by the data owner or organizational policy to protect data in transit to or from the firewall or to protect data in storage on the firewall.

STIG	Date
Firewall Security Requirements Guide	2012-12-10

Details

Check Text ( C-SRG-NET-000220-FW-000138_chk )
Verify any cryptographic modules used to protect information in transit to and from firewall or data in storage on firewall are on the NIST Cryptographic Algorithm Validation Program (CAVP) product lists. If FIPS 140-2 validated cryptography is not used to protect unclassified information while in transit or in storage, this is a finding.

Fix Text (F-SRG-NET-000220-FW-000138_fix)
Install a FIPS-140-2 validated cryptography to protect unclassified information while in transit or in storage as required by the data owner or organizational policy.