| This control applies to information transmitted by the firewall application. Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), SSL VPN, or IPSEC tunnel. Without confidentiality controls, information traveling over commercial or internal networks could be viewed or compromised without detection.
Alternative physical protection measures include Protected Distribution Systems (PDS). PDS are used to transmit unencrypted classified National Security Information (NSI) through an area of lesser classification or control. Since the classified NSI is unencrypted, the PDS must provide adequate electrical, electromagnetic, and physical safeguards to deter exploitation. Refer to NSTSSI No. 7003 for additional details on a PDS.
Firewall management traffic and other privileged communications originating from the firewall must be protected by confidentiality mechanisms while in transit (i.e., transmission encryption). |
