An IIS 8.5 web server must maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-76759	IISW-SV-000153	SV-91455r2_rule		High

Description

Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled. FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.

STIG	Date
IIS 8.5 Server Security Technical Implementation Guide	2019-10-01

Details

Check Text ( C-76415r2_chk )

Access the IIS 8.5 Web Server. Access an administrator command prompt and type "regedit " to access the server's registry. Navigate to: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server Verify a REG_DWORD value of "0" for "DisabledByDefault" Navigate to: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server Verify a REG_DWORD value of "1" for "DisabledByDefault" Verify a REG_DWORD value of "0" for "Enabled" If any of the respective registry paths do not exist or are configured with the wrong value, this is a finding.

Fix Text (F-83455r2_fix)

Access the IIS 8.5 Web Server. Access an administrator command prompt and type "regedit " to access the server's registry. Navigate to the following registry paths and configure the "DisabledByDefault" REG_DWORD with the appropriate values: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server With a REG_DWORD value of "0" for "DisabledByDefault" HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server With a REG_DWORD value of "1" for "DisabledByDefault" With a REG_DWORD value of "0" for "Enabled"