OpenControls Logo

STIG Viewer

STIGViewer Support

Ax-OS must protect the authenticity of communications sessions.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-276013AXOS-00-000065SV-276013r1122689_ruleCCI-001184high
Description
Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions. Application communication sessions are protected using transport encryption protocols such as Transport Layer Security (TLS). TLS provides web applications with a means to authenticate user sessions and encrypt application traffic. Session authentication can be single (one way) or mutual (two way) in nature. Single authentication authenticates the server for the client, whereas mutual authentication provides a means for the client and server to authenticate each other. This requirement applies to applications that use communications sessions. This includes, but is not limited to, web-based applications and service-oriented architectures (SOAs). This requirement addresses communications protection at the application session versus the network packet. It also establishes grounds for confidence at both ends of communications sessions in relation to the ongoing identities of other parties and validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/SOA will require the use of TL) mutual authentication (two-way/bidirectional). Satisfies: SRG-APP-000219, SRG-APP-000910
STIGDate
Axonius Federal Systems Ax-OS Security Technical Implementation Guide2025-11-25

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-09Session Integrity
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (30) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AU-10(1)Association of Identities
1.00
AU-10(2)Validate Binding of Information Producer Identity
1.00
AU-9(3)Cryptographic Protection
1.00
CM-14Signed Components
1.00
CM-5(3)Signed Components
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
IA-2(1)Multi-factor Authentication to Privileged Accounts
1.00
IA-2(12)Acceptance of PIV Credentials
1.00

+20 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.13.15
1.00
CCI1 mapping
CCI-001184
1.00

Details

Check Text (C-276013r1122689_chk)

Select the gear icon (System Settings) >> Privacy and Security >> Certificate and Encryption. Under SSL Certificate, if the certificate has not been changed from the self-signed default certificate, unless otherwise approved by the authorizing official (AO), this is a finding. Under Certificate Verifications Settings, if "Use OCSP" is not selected, this is a finding. Under SSL Trust & CA Settings, if "Use custom certificate" is not selected and configured for a DOD PKI (or other AO-approved certificate), this is a finding. Under Mutual TLS Settings, if the "Enable mutual TLS" slide bar is not enabled, and the "Enforce client certificate validation" box is unchecked, this is a finding. Under Encryption Settings, if the "Allow legacy SSL cipher suites for adapters" is checked, this is a finding.

Fix Text (F-80056r1122688_fix)

Select the gear icon (System Settings) >> Privacy and Security >> Certificate and Encryption. Under Certificate Verifications Settings, select "Use OCSP". Under SSL Trust & CA Settings, select "Use custom certificate" and configure for a DOD PKI (or other AO-approved certificate). Under Mutual TLS Settings, enable the "Enable mutual TLS" slide bar. Check the "Enforce client certificate validation" box. Under Encryption Settings, ensure the "Allow legacy SSL cipher suites for adapters" box is unchecked.