STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must use appropriate cryptography in order to protect stored DoD information when required by the information owner or DoD policy.

DISA Rule

SV-222589r508029_rule

Vulnerability Number

V-222589

Group Title

SRG-APP-000429

Rule Version

APSC-DV-002350

Severity

CAT II

CCI(s)

• CCI-002476 - The information system implements cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined information system components.

Weight

10

Fix Recommendation

Identify data elements that require protection.

Document the data types and specify encryption requirements.

Encrypt classified data using Type 1, Suite B, or other NSA-approved encryption solutions.

Check Contents

Review the application documentation and interview the application administrator.

Identify the data processed by the application and the accompanying data protection requirements.

Determine if the application is processing publicly releasable, SBU, FOUO, or classified data.

If the data is strictly publicly releasable information with no SBU, FOUO, or classified and system documentation specifies no data encryption is required for any hosted application data, this requirement is not applicable.

Have the application administrator identify the encryption protections that are utilized.

Validate the application is using encryption protections that are commensurate with the data being protected.

If the application is processing classified data, type 1, suite B cryptography, or hardware-based encryption solutions; meeting NSA encryption requirements for classified data processing and storage is required.

If the application processes classified data or if the data owner has specified encryption requirements and the application administrator is unable to demonstrate the type of encryption used or if the application processes classified and does not use type 1, suite B, or NSA-approved hardware-based encryption, this is a finding.

Vulnerability Number

V-222589

Documentable

False

Rule Version

APSC-DV-002350

Severity Override Guidance

Review the application documentation and interview the application administrator.

Identify the data processed by the application and the accompanying data protection requirements.

Determine if the application is processing publicly releasable, SBU, FOUO, or classified data.

If the data is strictly publicly releasable information with no SBU, FOUO, or classified and system documentation specifies no data encryption is required for any hosted application data, this requirement is not applicable.

Have the application administrator identify the encryption protections that are utilized.

Validate the application is using encryption protections that are commensurate with the data being protected.

If the application is processing classified data, type 1, suite B cryptography, or hardware-based encryption solutions; meeting NSA encryption requirements for classified data processing and storage is required.

If the application processes classified data or if the data owner has specified encryption requirements and the application administrator is unable to demonstrate the type of encryption used or if the application processes classified and does not use type 1, suite B, or NSA-approved hardware-based encryption, this is a finding.

Check Content Reference

M

Target Key

4093

Comments