OpenControls Logo

STIG Viewer

STIGViewer Support

The ICS must be configured to use an approved Commercial Solution for Classified (CSfC) when transporting classified traffic across an unclassified network.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-258595IVCS-VN-000350SV-258595r1117244_ruleCCI-002450medium
Description
Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The National Security Agency/Central Security Service's (NSA/CSS) CSfC Program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Currently, Suite B cryptographic algorithms are specified by NIST and are used by NSA's Information Assurance Directorate in solutions approved for protecting classified and unclassified NSS. However, quantum resistant algorithms will be required for future required Suite B implementations. Satisfies: SRG-NET-000352-VPN-001460, SRG-NET-000565-VPN-002400, SRG-NET-000565-VPN-002390
STIGDate
Ivanti Connect Secure VPN Security Technical Implementation Guide2025-09-09

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (9) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-02Secure Baseline Configurations
1.00
CRY-01Use of Cryptographic Controls
1.00
CRY-01.1Alternate Physical Protection
1.00
CRY-03Transmission Confidentiality
1.00
CRY-04Transmission Integrity
1.00
CRY-05Encrypting Data At Rest
1.00
DCH-01Data Protection
1.00
IAC-21Least Privilege
1.00
CRY-01.2Export-Controlled Cryptography
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (29) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-3Access Enforcement
1.00
AU-9(3)Cryptographic Protection
1.00
CM-5(6)Limit Library Privileges
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
IA-2(8)Access to Accounts — Replay Resistant
1.00
IA-2(9)Network Access to Non-privileged Accounts — Replay Resistant
1.00
IA-3(1)Cryptographic Bidirectional Authentication
1.00
IA-5(1)Password-based Authentication
1.00

+19 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.13.11
1.00
CCI1 mapping
CCI-002450
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.DS-01
1.00
PR.DS-02
1.00
PR.DS-10
1.00

Who does this work

8 NICE work roles and 7 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-258595r1117244_chk)

If the ICS VPN Gateway is not being used to carry classified data (e.g., Secret, Top Secret, etc.), this is Not Applicable. 1. Navigate to System >> Configuration >> Inbound SSL Options. Verify that under "Allowed Encryption Strength", if "SuiteB - Accept only SuiteB ciphers" is checked. 2. Navigate to System >> Configuration >> Certificates >> Device Certificates. Verify the certificate being used by the ICS is an ECC P-384 Public Key. If the ICS is not configured to use only SuiteB ciphers with ECC P-384 keys for transporting classified traffic, this is a finding.

Fix Text (F-62244r930472_fix)

In the ICS Web UI, navigate to System >> Configuration >> Certificates >> Device Certificates. 1. Click "New CSR". 2. Add a Common Name in FQDN format. 3. Add a Country code of "US". 4. Under key type, select "ECC". 5. Under the key length, select "P-384". 6. Click "Create CSR". 7. Copy the Base 64/PEM encoded certificate request that is shown on the screen and paste it to a text file. Ensure the file has the file suffix of .csr. 8. Go through the local RA process for DOD Web Server certificate requests. Ensure that SANs are added to the certificate by the issuing CA to include the hostname, cluster names, and all FQDNs. 9. Once the certificate is provided by the CA, go to System >> Configuration >> Certificates >> Device Certificates. 10. Click "Browse" and select the certificate file issued by the CA. Then click "Import". 11. Click "Save Changes". 12. Click on the imported certificate. 13. On the "Internal Port", click "add" for the cluster internal VIP and <Internal Port>. 14. On the "External Port" click "add" for the cluster external VIP and <External Port>. 15. Check the box for "Management Port". 16. Under "Certificate Status Checking", click the box for "Use CRLs". 17. Click "Save Changes". In the ICS Web UI, navigate to System >> Configuration >> Inbound SSL Options. 1. Under "Allowed Encryption Strength", click "SuiteB - Accept only SuiteB ciphers". 2. Click "Save Changes" and accept the cipher suite changes.