The firewall implementation must use cryptographic mechanisms to detect changes to information during transmission, unless otherwise protected by alternative physical measures.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-37294	SRG-NET-000208-FW-000124	SV-49055r1_rule		Medium

Description
This control applies to information transmitted by the firewall application. Preventing the disclosure of information while in transit requires applications to take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), SSL VPN, or IPSEC tunnel. Without integrity controls, information traveling over commercial or internal networks could be altered or compromised without detection. Alternative physical protection measures include Protected Distribution Systems (PDS). PDS are used to transmit unencrypted classified National Security Information (NSI) through an area of lesser classification or control. Since the classified NSI is unencrypted, the PDS must provide adequate electrical, electromagnetic, and physical safeguards to deter exploitation. Refer to NSTSSI No. 7003 for additional details on a PDS. Firewall management traffic and other privileged communications originating from the firewall must be protected by integrity mechanisms while in transit (i.e., transmission encryption).

Description

This control applies to information transmitted by the firewall application. Preventing the disclosure of information while in transit requires applications to take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), SSL VPN, or IPSEC tunnel. Without integrity controls, information traveling over commercial or internal networks could be altered or compromised without detection. Alternative physical protection measures include Protected Distribution Systems (PDS). PDS are used to transmit unencrypted classified National Security Information (NSI) through an area of lesser classification or control. Since the classified NSI is unencrypted, the PDS must provide adequate electrical, electromagnetic, and physical safeguards to deter exploitation. Refer to NSTSSI No. 7003 for additional details on a PDS. Firewall management traffic and other privileged communications originating from the firewall must be protected by integrity mechanisms while in transit (i.e., transmission encryption).

STIG	Date
Firewall Security Requirements Guide	2013-04-24

Details

Check Text ( C-45541r1_chk )
If the information is protected by a physical security solution (e.g., PDS or physical access control) while in transit, this is not applicable. Inspect the encryption configuration for each management interface. Verify a cryptographic mechanism is configured to use an approved hashing algorithm to protect information in transit. If the firewall implementation does not use cryptographic mechanisms to detect changes made to information while in transit, this is a finding.

Check Text ( C-45541r1_chk )

If the information is protected by a physical security solution (e.g., PDS or physical access control) while in transit, this is not applicable.

Inspect the encryption configuration for each management interface.
Verify a cryptographic mechanism is configured to use an approved hashing algorithm to protect information in transit.

If the firewall implementation does not use cryptographic mechanisms to detect changes made to information while in transit, this is a finding.

Fix Text (F-42219r1_fix)
Configure the cryptographic module on all interfaces capable of communications to use cryptographic mechanisms configured with an approved hashing algorithm.