The CA API Gateway providing user authentication intermediary services must transmit only encrypted representations of passwords.

From CA API Gateway ALG Security Technical Implementation Guide

Associated with: CCI-000197

SV-86087r1_rule The CA API Gateway providing user authentication intermediary services must transmit only encrypted representations of passwords.

Vulnerability discussion

Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised.This requirement applies to ALGs that provide user authentication intermediary services. This does not apply to authentication for the purpose of configuring the device itself (device management).The CA API Gateway must require SSL or TLS when accessing a Registered Service. By requiring SSL or TLS to access a Registered Service, passwords will be encrypted by the CA API Gateway even if the back-end server does not require passwords to be encrypted or have SSL enabled.

Check content

Open the CA API Gateway - Policy Manager and open each of the Registered Services that requires the authentication passwords to be protected. Verify the "Require SSL or TLS Transport" Assertion is present. If it is not, this is a finding.

Fix text

Open the CA API Gateway - Policy Manager and open each of the Registered Services that requires authentication passwords to be protected and that does not include the "Require SSL or TLS Transport" Assertion. Add the "Require SSL or TLS Transport" Assertion and click the "Save and Activate" button to activate the changes to the policy.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.