The network device must employ cryptographic mechanisms to prevent unauthorized disclosure of information during transmission, unless otherwise protected by alternative physical measures.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000211-NDM-000154	SRG-NET-000211-NDM-000154	SRG-NET-000211-NDM-000154_rule		Medium

Description
This control applies to information transmitted by the network device application. Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), SSL VPN, or IPSEC tunnel. Without confidentiality controls, information traveling over commercial or internal networks could be viewed or compromised without detection. Alternative physical protection measures include Protected Distribution Systems (PDS). PDS are used to transmit unencrypted classified National Security Information (NSI) through an area of lesser classification or control. Since the classified NSI is unencrypted, the PDS must provide adequate electrical, electromagnetic, and physical safeguards to deter exploitation. Refer to NSTSSI No. 7003 for additional details on a PDS. Network device management traffic and other privileged communications originating from the network device must be protected by confidentiality mechanisms while in transit (i.e., transmission encryption).

Description

This control applies to information transmitted by the network device application. Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), SSL VPN, or IPSEC tunnel. Without confidentiality controls, information traveling over commercial or internal networks could be viewed or compromised without detection. Alternative physical protection measures include Protected Distribution Systems (PDS). PDS are used to transmit unencrypted classified National Security Information (NSI) through an area of lesser classification or control. Since the classified NSI is unencrypted, the PDS must provide adequate electrical, electromagnetic, and physical safeguards to deter exploitation. Refer to NSTSSI No. 7003 for additional details on a PDS. Network device management traffic and other privileged communications originating from the network device must be protected by confidentiality mechanisms while in transit (i.e., transmission encryption).

STIG	Date
Network Device Management Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000211-NDM-000154_chk )
If the information is protected by a physical security solution (e.g., PDS or physical access control) while in transit, this is not applicable. Verify encryption is automatically used for all data in transit. If the system is not configured to use cryptographic mechanisms to protect information in transit, this is a finding.

Fix Text (F-SRG-NET-000211-NDM-000154_fix)
Configure the device so a cryptographic mechanism is automatically used for all data in transit.