The ALG providing user authentication intermediary services must transmit only encrypted representations of passwords.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-205026 | SRG-NET-000400-ALG-000097 | SV-205026r396453_rule | CCI-000197 | medium |
| Description | ||||
| Passwords need to be protected at all times and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. This requirement applies to ALGs that provide user authentication intermediary services. This does not apply to authentication for the purpose of configuring the device itself (device management). | ||||
| STIG | Date | |||
| Application Layer Gateway Security Requirements Guide | 2024-12-04 | |||
Details
Check Text (C-205026r396453_chk)
If the ALG does not provide user authentication intermediary services, this is not applicable.
Verify the ALG transmits only encrypted representations of passwords.
If the ALG does not transmit only encrypted representations of passwords, this is a finding.
Fix Text (F-5294r396452_fix)
If user authentication intermediary services are provided, configure the ALG to transmit only encrypted representations of passwords.