Title

The container platform must use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality. (Cat I impact)

Discussion

Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard. Cryptographic module used must have one FIPS-validated encryption algorithm (i.e., validated Advanced Encryption Standard [AES]). This validated algorithm must be used for encryption for cryptographic security function within the container platform component and information residing in the container platform registry and keystore.

Check Content

Review the container platform configuration to ensure FIPS-validated cryptographic modules are implemented to encrypt unclassified information requiring confidentiality. If FIPS-validated cryptographic modules are not being used, this is a finding.

Fix Text

Configure the container platform to use FIPS-validated cryptographic modules to encrypt unclassified information requiring confidentiality.

Additional Identifiers

Rule ID: SV-233289r879902_rule

Vulnerability ID: V-233289

Group Title: SRG-APP-000635

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.