UCF STIG Viewer Logo

The IDPS must produce, control, and distribute asymmetric cryptographic keys using approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user's private key.


Overview

Finding ID Version Rule ID IA Controls Severity
SRG-NET-000218-IDPS-NA SRG-NET-000218-IDPS-NA SRG-NET-000218-IDPS-NA_rule Medium
Description
The escalating use of cryptography has brought forth a huge challenge for organizations to protect and manage the hundreds and even thousands of cryptographic keys employed during daily cryptographic transactions. The most secure algorithm is rendered useless if the keys cannot be kept secured. Left unprotected keys are vulnerable to duplication or modification. Duplication enables an attacker to copy a key to be used for access to the service and steal information. An attacker will modify or corrupt a key to cause a Denial-of-Service. The secure administration and distribution of cryptographic keys is a necessary and critical aspect of risk mitigation. Key management is the process of generating and securely distributing keys used in the encryption process. It is the practice of implementing a security key management policy to protect cryptographic operations from compromise and abuse. The policy must include key generation, distribution, storage, usage, lifetime duration, and destruction. Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. In addition to being required for the effective operation of a cryptographic mechanism, effective cryptographic key management provides protections to maintain the availability of the information in the event of the loss of cryptographic keys by users.
STIG Date
IDPS Security Requirements Guide (SRG) 2012-03-08

Details

Check Text ( C-43316_chk )
This requirement does not apply to IDPS.
Fix Text (F-43316_fix)
Not applicable for IDPS. No fix required.