OpenControls Logo

STIG Viewer

STIGViewer Support

The Palo Alto Networks security platform must only allow the use of secure protocols that implement cryptographic mechanisms to protect the integrity of maintenance and diagnostic communications for nonlocal maintenance sessions.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-228669PANW-NM-000117SV-228669r961554_ruleCCI-002890medium
Description
This requires the use of secure protocols instead of their unsecured counterparts, such as SSH instead of telnet, SCP instead of FTP, and HTTPS instead of HTTP. Note that HTTP OCSP is permitted to support OCSP where used. If unsecured protocols (lacking cryptographic mechanisms) are used for sessions, the contents of those sessions will be susceptible to manipulation, potentially allowing alteration and hijacking of maintenance sessions.
STIGDate
Palo Alto Networks NDM Security Technical Implementation Guide2025-03-12

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MNT-05.3Remote Maintenance Cryptographic Protection
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (25) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(4)Automated Audit Actions
1.00
AC-4Information Flow Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
AU-9(3)Cryptographic Protection
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-6Configuration Settings
1.00

+15 more (top 10 by confidence shown)

CCI1 mapping
CCI-002890
1.00

Details

Check Text (C-228669r961554_chk)

Go to Device >> Setup >> Management In the "Management Interface Settings" window, view the enabled services. Note: Which management services are enabled. If Telnet or HTTP is selected, this is a finding.

Fix Text (F-30881r513611_fix)

Go to Device >> Setup >> Management. In the "Management Interface Settings" window, select the "Edit" icon (the gear symbol in the upper-right corner). In the "Management Interface Settings" window, make sure that Telnet or HTTP are not selected. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.