The application must use appropriate cryptography in order to protect stored DoD information when required by the information owner or DoD policy.

From Application Security and Development Security Technical Implementation Guide

Part of SRG-APP-000429

Associated with: CCI-002476

SV-84851r1_rule The application must use appropriate cryptography in order to protect stored DoD information when required by the information owner or DoD policy.

Vulnerability discussion

Applications handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.Selection of a cryptographic mechanism is based on the need to protect the confidentiality of organizational information. The strength of mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields).Special care must be taken to cryptographically protect classified data.

Check content

Review the application documentation and interview the application administrator. Identify the data processed by the application and the accompanying data protection requirements. Determine if the application is processing publicly releasable, SBU, FOUO, or classified data. If the data is strictly publicly releasable information with no SBU, FOUO, or classified and system documentation specifies no data encryption is required for any hosted application data, this requirement is not applicable. Have the application administrator identify the encryption protections that are utilized. Validate the application is using encryption protections that are commensurate with the data being protected. If the application is processing classified data, type 1, suite B cryptography, or hardware-based encryption solutions; meeting NSA encryption requirements for classified data processing and storage is required. If the application processes classified data or if the data owner has specified encryption requirements and the application administrator is unable to demonstrate the type of encryption used or if the application processes classified and does not use type 1, suite B, or NSA-approved hardware-based encryption, this is a finding.

Fix text

Identify data elements that require protection. Document the data types and specify encryption requirements. Encrypt classified data using Type 1, Suite B, or other NSA-approved encryption solutions.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer