OpenControls Logo

STIG Viewer

STIGViewer Support

Forescout must use a bidirectional authentication mechanism configured with a FIPS-validated Advanced Encryption Standard (AES) cipher block algorithm to authenticate with the endpoint device. This is required for compliance with C2C Step 1.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-233339FORE-NC-000460SV-233339r971529_ruleCCI-001967medium
Description
Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk. Currently, DoD requires the use of AES for bidirectional authentication since it is the only FIPS-validated AES cipher block algorithm. Because of the challenges of applying this requirement on a large scale, organizations are encouraged to apply the requirement only to those limited number (and type) of devices that truly need to support this capability.
STIGDate
Forescout Network Access Control Security Technical Implementation Guide2025-06-12

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-04Identification & Authentication for Devices
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (49) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(10)Authenticate Remote Commands
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-18(1)Authentication and Encryption
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-4(17)Domain Authentication
1.00
AC-7Unsuccessful Logon Attempts
1.00
AU-8Time Stamps
1.00

+39 more (top 10 by confidence shown)

CCI1 mapping
CCI-001967
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.AA-01
0.50
PR.AA-03
0.50
PR.AA-05
0.50

Details

Check Text (C-233339r971529_chk)

If DoD is not at C2C Step 1 or higher, this is not a finding. Use the Forescout CLI credentials to verify FIPS mode is set by running the "fstool version" command and look for the "FIPS enabled" setting. Log on using the CLIAdmin credentials established upon initial configuration. Verify FIPS mode by typing the command "fstool version". If Forescout does not use AES, this is a finding.

Fix Text (F-36499r803492_fix)

To enable FIPS mode, log in to the CLI account a use the "fstool fips" command. Note that use of FIPS mode is not mandatory in DoD. However, it is the primary method for mitigation of this requirement and ensuring FIPS compliance. Log on using the CLIAdmin credentials established upon initial configuration. To enable FIPS mode, type "fstool fips". A prompt alerting the user that FIPS 140-2 will be enabled will be displayed. Type "Yes" for FIPS to accept this prompt. Note: Use of FIPS mode is not mandatory in DoD. However, it is the primary method for mitigation of this requirement and ensuring FIPS compliance.