Applications must employ FIPS-validated cryptography to protect unclassified information when such information must be separated from individuals who have the necessary clearances yet lack the necessary access approvals.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-36338	SRG-APP-199-NA	SV-47742r1_rule		Medium

Description
Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. Use of weak or un-tested encryption algorithms undermines the purposes of utilizing encryption to protect data. FIPS 140-2 Security Requirements for Cryptographic Modules can be found at the following web site: http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf. Rationale for non-applicability: The MDM server does not manage access to data by clearances of administrators.

Description

Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. Use of weak or un-tested encryption algorithms undermines the purposes of utilizing encryption to protect data. FIPS 140-2 Security Requirements for Cryptographic Modules can be found at the following web site: http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf. Rationale for non-applicability: The MDM server does not manage access to data by clearances of administrators.

STIG	Date
Mobile Device Manager Security Requirements Guide	2013-01-24

Details

Check Text ( C-44580r1_chk )
This requirement is NA for the MDM server SRG.

Fix Text (F-40870r1_fix)
The requirement is NA. No fix is required.