OpenControls Logo

STIG Viewer

STIGViewer Support

The Sentry that provides intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-251013MOIS-AL-000180SV-251013r1028178_ruleCCI-000068medium
Description
SP 800-52 provides guidance on using the most secure version and configuration of the TLS/SSL protocol. Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks which exploit vulnerabilities in this protocol.
STIGDate
Ivanti Sentry 9.x ALG Security Technical Implementation Guide2024-09-25

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-14.2Protection of Confidentiality / Integrity Using Encryption
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (33) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-3Access Enforcement
1.00
CM-6Configuration Settings
1.00
CM-6(1)Automated Management, Application, and Verification
1.00
CM-7Least Functionality
1.00
CM-7(1)Periodic Review
1.00
IA-2(8)Access to Accounts — Replay Resistant
1.00
IA-2(9)Network Access to Non-privileged Accounts — Replay Resistant
1.00
IA-3Device Identification and Authentication
1.00

+23 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.13
1.00
CCI1 mapping
CCI-000068
1.00

Details

Check Text (C-251013r1028178_chk)

Verify the Sentry is configured to implement the applicable required TLS settings in NIST PUB SP 800-52. 1. Log in to Sentry. 2. Go to Settings >> Services >> Sentry. 3. For each of the following configurations, follow the step 4 procedure: a. Incoming SSL configuration b. Outgoing SSL configuration c. UEM SSL configuration d. Access SSL configuration 4. Verify only TLS 1.2 is selected. If any other protocol is selected, this is a finding. For more information, go to the "Sentry 9.8.0 guide for Core" and refer the main section "Standalone Sentry Settings", which includes subsections on how TLS 1.2 is set as the default protocol: 1. Incoming SSL configuration 2. Outgoing SSL configuration 3. UEM SSL configuration 4. Access SSL configuration Sentry conforms to the NIST SP 800-52 TLS settings by setting TLS 1.2 by default.

Fix Text (F-54402r1004764_fix)

Configure the Sentry to comply with applicable required TLS settings in NIST PUB SP 800-52. 1. Log in to Sentry. 2. Go to Settings >> Services >> Sentry. 3. For each of the following configurations, follow the step 4 procedure: a. Incoming SSL configuration b. Outgoing SSL configuration c. UEM SSL configuration d. Access SSL configuration 4. Select only TLS 1.2 and remove others if selected. 5. Click "Apply".