The network device must employ cryptographic mechanisms to protect information in storage.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000180-NDM-000139	SRG-NET-000180-NDM-000139	SRG-NET-000180-NDM-000139_rule		Low

Description
When data is written to digital media, there is the risk of loss of data along with integrity and data confidentiality. An organizational assessment of risk guides the selection of media and associated information contained on the media requiring physical protection. Fewer protection measures are needed for media containing information determined by the organization to be in the public domain, to be publicly releasable, or to have limited or no adverse impact on the organization or individuals if accessed by other than authorized personnel. In these situations, it is assumed the physical access controls to the facility where the media resides provide adequate protection. As part of a defense-in-depth strategy, the organization considers routinely encrypting information at rest on selected secondary storage devices. The employment of cryptography is at the discretion of the information owner. The strength of mechanisms is commensurate with the classification and sensitivity of the information. This includes application event logs, backed-up data, and audit logs.

Description

When data is written to digital media, there is the risk of loss of data along with integrity and data confidentiality. An organizational assessment of risk guides the selection of media and associated information contained on the media requiring physical protection. Fewer protection measures are needed for media containing information determined by the organization to be in the public domain, to be publicly releasable, or to have limited or no adverse impact on the organization or individuals if accessed by other than authorized personnel. In these situations, it is assumed the physical access controls to the facility where the media resides provide adequate protection. As part of a defense-in-depth strategy, the organization considers routinely encrypting information at rest on selected secondary storage devices. The employment of cryptography is at the discretion of the information owner. The strength of mechanisms is commensurate with the classification and sensitivity of the information. This includes application event logs, backed-up data, and audit logs.

STIG	Date
Network Device Management Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000180-NDM-000139_chk )
Review the network device vendor documentation to determine whether data stored within the network device is encrypted according to organization defined requirements. This includes application event logs, backed-up data, and audit logs. If the network device is not configured to encrypt information in storage, this is a finding.

Fix Text (F-SRG-NET-000180-NDM-000139_fix)
Configure the network device to protect information in storage (including primary and backed-up information) with cryptographic mechanisms.