Remote access into the test and development environment must use an encryption mechanism approved for the classification level of the network.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-39667	ENTD0280	SV-51534r1_rule	EBRU-1 ECCT-1 ECCT-2	Medium

Description
Remote access to the environment using unapproved encryption mechanism is inherently dangerous because anyone with a packet sniffer and access to the network can acquire the device's account and password information. With this intercepted information, a malicious user could gain access to the device, cause denial of service attacks, intercept sensitive information, or perform other destructive actions.

Description

Remote access to the environment using unapproved encryption mechanism is inherently dangerous because anyone with a packet sniffer and access to the network can acquire the device's account and password information. With this intercepted information, a malicious user could gain access to the device, cause denial of service attacks, intercept sensitive information, or perform other destructive actions.

STIG	Date
Test and Development Zone B Security Technical Implementation Guide	2018-09-17

Details

Check Text ( C-46822r1_chk )
Determine whether the proper encryption standard is deployed for the classification of the network where remote access is performed. Unclassified/FOUO or any need-to-know data will need to use a FIPS 140-2 validated cryptographic module. Classified traffic must use an NSA approved encryption standard. If the proper encryption standard is not in use for remote access, this is a finding.

Fix Text (F-44675r1_fix)
Implement an approved encryption mechanism for the classification of the network for remote access. Unclassified/FOUO or any need-to-know data will need to use a FIPS 140-2 validated cryptographic module. Classified traffic must use an NSA approved encryption standard.