STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must transmit only cryptographically-protected passwords.

DISA Rule

SV-222543r508029_rule

Vulnerability Number

V-222543

Group Title

SRG-APP-000172

Rule Version

APSC-DV-001750

Severity

CAT I

CCI(s)

• CCI-000197 - The information system, for password-based authentication, transmits only cryptographically-protected passwords.

Weight

10

Fix Recommendation

Configure the application to encrypt passwords when they are being transmitted.

Check Contents

Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.

If the application does not use passwords, the requirement is not applicable.

Identify when the application transmits passwords. This will most likely be when the user authenticates to the application or when the application authenticates to another resource.

Access the application management interface with a test account and access the functionality that requires a password be provided. If the interface is via a web browser, verify the web browser has gone secure prior to entering any password or authentication information.

This can be done by viewing the browser and observing a “lock” icon displayed somewhere in the browser as well as an https:// to indicate an SSL connection. Most browsers display this in the upper left hand corner.

If the application is transmitting the password rather than the user, obtain design documentation from the application admin that provides the details on how they are protecting the password during transmission. This will usually be via a TLS/SSL tunneled connection or VPN.

If the passwords are not encrypted when being transmitted, this is a finding.

Vulnerability Number

V-222543

Documentable

False

Rule Version

APSC-DV-001750

Severity Override Guidance

Review the application documentation and interview the application administrator to identify if the application uses passwords for user authentication.

If the application does not use passwords, the requirement is not applicable.

Identify when the application transmits passwords. This will most likely be when the user authenticates to the application or when the application authenticates to another resource.

Access the application management interface with a test account and access the functionality that requires a password be provided. If the interface is via a web browser, verify the web browser has gone secure prior to entering any password or authentication information.

This can be done by viewing the browser and observing a “lock” icon displayed somewhere in the browser as well as an https:// to indicate an SSL connection. Most browsers display this in the upper left hand corner.

If the application is transmitting the password rather than the user, obtain design documentation from the application admin that provides the details on how they are protecting the password during transmission. This will usually be via a TLS/SSL tunneled connection or VPN.

If the passwords are not encrypted when being transmitted, this is a finding.

Check Content Reference

M

Target Key

4093

Comments