Remote access into the test and development environment must use an encryption mechanism approved for the classification level of the network.

From Test and Development Zone B Security Technical Implementation Guide

Part of ENTD0280 - An approved encryption mechanism is not used for remote access.

Associated with IA controls: EBRU-1, ECCT-1, ECCT-2

SV-51534r1_rule Remote access into the test and development environment must use an encryption mechanism approved for the classification level of the network.

Vulnerability discussion

Remote access to the environment using unapproved encryption mechanism is inherently dangerous because anyone with a packet sniffer and access to the network can acquire the device's account and password information. With this intercepted information, a malicious user could gain access to the device, cause denial of service attacks, intercept sensitive information, or perform other destructive actions.

Check content

Determine whether the proper encryption standard is deployed for the classification of the network where remote access is performed. Unclassified/FOUO or any need-to-know data will need to use a FIPS 140-2 validated cryptographic module. Classified traffic must use an NSA approved encryption standard. If the proper encryption standard is not in use for remote access, this is a finding.

Fix text

Implement an approved encryption mechanism for the classification of the network for remote access. Unclassified/FOUO or any need-to-know data will need to use a FIPS 140-2 validated cryptographic module. Classified traffic must use an NSA approved encryption standard.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.