The router must use NIST-validated FIPS 140-2 cryptography to implement authentication encryption mechanisms. This applies to passwords, and routing protocol authentication.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000168-RTR-000078	SRG-NET-000168-RTR-000078	SRG-NET-000168-RTR-000078_rule		Medium

Description
Network elements not protected with strong passwords provide the opportunity for anyone to crack the password thus gaining access to the system and the network. All passwords must be kept and known only by the account user who created the password. Malicious users can gain knowledge of passwords during the authentication process by sniffing local traffic between the network element and the authentication server. It is imperative the authentication process implements cryptographic modules adhering to the higher standards approved by the federal government. This will be a permanent finding as most routing protocols and mechanisms to encrypt passwords on a router are not FIPS 140-2 compliant. This requirement is not listed as NA due to the importance of industry adding the FIPS 140-2 encryption capability to routers.

Description

Network elements not protected with strong passwords provide the opportunity for anyone to crack the password thus gaining access to the system and the network. All passwords must be kept and known only by the account user who created the password. Malicious users can gain knowledge of passwords during the authentication process by sniffing local traffic between the network element and the authentication server. It is imperative the authentication process implements cryptographic modules adhering to the higher standards approved by the federal government. This will be a permanent finding as most routing protocols and mechanisms to encrypt passwords on a router are not FIPS 140-2 compliant. This requirement is not listed as NA due to the importance of industry adding the FIPS 140-2 encryption capability to routers.

STIG	Date
Router Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000168-RTR-000078_chk )
Review the router documentation to verify it is using NIST-validated FIPS 140-2 compliant cryptography for encrypted authentication mechanisms. If NIST-validated FIPS 140-2 compliant cryptography is not being used for all encrypted authentication mechanisms, this is a finding.

Fix Text (F-SRG-NET-000168-RTR-000078_fix)
Configure all authentication mechanisms using encryption to use FIPS 140-2 validated algorithms.