Check: CVAD-LS-001005
Citrix Virtual Apps and Desktop 7.x License Server STIG:
CVAD-LS-001005
(in version v1 r1)
Title
Citrix License Server must implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution Systems (PDS). (Cat I impact)
Discussion
Encrypting information for transmission protects information from unauthorized disclosure and modification. Cryptographic mechanisms implemented to protect information integrity include, for example, cryptographic hash functions that have common application in digital signatures, checksums, and message authentication codes. This requirement applies only to applications that are distributed or can allow access to data non-locally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, applications need to leverage transmission protection mechanisms, such as TLS, SSL VPNs, or IPsec. Alternative physical protection measures include PDS. PDSs are used to transmit unencrypted classified National Security Information (NSI) through an area of lesser classification or control. Since the classified NSI is unencrypted, the PDS must provide adequate electrical, electromagnetic, and physical safeguards to deter exploitation.
Check Content
Open the License Management Console, click "Administration", and select the "Server Configuration" tab. Click the "Secure Web Server Configuration" bar and verify "Select Enable HTTPS (Default 443)" is selected. If "Select Enable HTTPS (Default 443)" is not selected, this is a finding.
Fix Text
1. Copy a valid server certificate file and server certificate key file into the \\Citrix\Licensing\LS\conf\ folder of the License Server installation directory. 2. Click "Administration" and select the "Server Configuration" tab. 3. Click the "Secure Web Server Configuration" bar. 4. Select "Enable HTTPS (Default 443)". 5. Enter a port for the HTTPS communication. 6. Enter the location of the server certificate file and the server certificate key file. 7. Stop and restart the Citrix Licensing service from the services control panel of the machine running the license server.
Additional Identifiers
Rule ID: SV-234227r628795_rule
Vulnerability ID: V-234227
Group Title: SRG-APP-000440
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-002421 |
The information system implements cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by organization-defined alternative physical safeguards. |
Controls
Number | Title |
---|---|
SC-8 (1) |
Cryptographic Or Alternate Physical Protection |