UCF STIG Viewer Logo

FTP / Telnet unencryted transmissions require Acknowledgement of Risk Letter(AORL)


Overview

Finding ID Version Rule ID IA Controls Severity
V-8271 IFTP0100 SV-8757r2_rule DCCS-1 DCCS-2 EBRU-1 ECCT-1 ECCT-2 Medium
Description
In addition to the data transmission being in the clear, the user credentials are also passed in the clear, which violates the control IAIA-1. As mitigation for this vulnerability, special consideration must be given to account maintenance and the types of user privileges associated with these accounts. Interception of the above information could result in the compromise of the operating system environment, ACP, and customer data.
STIG Date
z/OS RACF STIG 2019-12-12

Details

Check Text ( C-20020r1_chk )
a) Provide a list of all FTP userids defined to the ACP database, including the function and purpose of each FTP userid.

b) Refer to the to the above list

c) Ensure that an Acknowledgement of Risk Letter exist for all userids utilizing unencrypted communications.

d) If (c) is true, there is NO FINDING.

e) If (c) is untrue, this is a FINDING.
Fix Text (F-12415r1_fix)
Ensure that an Acknowledgement of Risk Letter exist for all userids utilizing unencrypted communications.