STIGQter: STIG Summary: Symantec ProxySG NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 24 Jan 2020:

Symantec ProxySG must transmit only encrypted representations of passwords.

DISA Rule

SV-104533r1_rule

Vulnerability Number

V-94703

Group Title

SRG-APP-000172-NDM-000259

Rule Version

SYMP-NM-000260

Severity

CAT I

CCI(s)

• CCI-000197 - The information system, for password-based authentication, transmits only cryptographically-protected passwords.

Weight

10

Fix Recommendation

Enable TLS management services.

1. Log on to the Web Management Console.
2. Click Configuration >> Services >> Management Services.
3. Ensure "HTTPS-Console" is already enabled.
4. Ensure "HTTP-Console" is not enabled.
5. Click "Apply".

Check Contents

Verify only TLS management services are enabled.

1. Log on to the Web Management Console.
2. Click Configuration >> Services >> Management Services.
3. Ensure that "HTTP-Console" is not enabled and that "HTTPS-Console" is enabled.

If Symantec ProxySG does not transmit only encrypted representations of passwords, this is a finding.

Vulnerability Number

V-94703

Documentable

False

Rule Version

SYMP-NM-000260

Severity Override Guidance

Verify only TLS management services are enabled.

1. Log on to the Web Management Console.
2. Click Configuration >> Services >> Management Services.
3. Ensure that "HTTP-Console" is not enabled and that "HTTPS-Console" is enabled.

If Symantec ProxySG does not transmit only encrypted representations of passwords, this is a finding.

Check Content Reference

M

Target Key

3517

Comments