STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must use the Federal Information Processing Standard (FIPS) 140-2-validated cryptographic modules and random number generator if the application implements encryption, key exchange, digital signature, and hash functionality.

DISA Rule

SV-222583r508029_rule

Vulnerability Number

V-222583

Group Title

SRG-APP-000224

Rule Version

APSC-DV-002290

Severity

CAT II

CCI(s)

• CCI-001188 - The information system generates unique session identifiers for each session with organization-defined randomness requirements.

Weight

10

Fix Recommendation

Configure the application to use FIPS 140-2-validated cryptographic modules when the application implements encryption, key exchange, digital signatures, random number generators, and hash functionality.

Check Contents

Review the application documentation and interview the application administrator.

Identify if the application implements encryption, key exchange, digital signature, or hash functionality.

Identify the cryptographic modules utilized by the application for these functions. The application may be designed to use the crypto functionality of the underlying OS or it may be a product of the application itself.

Identify the cryptographic service provider utilized by the application and reference the NIST validation website to ensure the algorithms utilized are approved.

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm

If the application does not use FIPS 140-2-approved encryption algorithms, this is a finding.

Vulnerability Number

V-222583

Documentable

False

Rule Version

APSC-DV-002290

Severity Override Guidance

Review the application documentation and interview the application administrator.

Identify if the application implements encryption, key exchange, digital signature, or hash functionality.

Identify the cryptographic modules utilized by the application for these functions. The application may be designed to use the crypto functionality of the underlying OS or it may be a product of the application itself.

Identify the cryptographic service provider utilized by the application and reference the NIST validation website to ensure the algorithms utilized are approved.

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm

If the application does not use FIPS 140-2-approved encryption algorithms, this is a finding.

Check Content Reference

M

Target Key

4093

Comments