Check: WSDP-AG-000137
IBM DataPower ALG STIG:
WSDP-AG-000137
(in version v1 r1)
Title
The DataPower Gateway providing encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes. (Cat II impact)
Discussion
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. This requirement applies only to ALGs that provide encryption intermediary services (e.g., HTTPS, TLS, or DNSSEC).
Check Content
From the web interface for DataPower device management, verify that the DataPower Gateway Cryptographic Mode is Set to FIPS 140-2 Level 1 (Status >> Crypto >> Cryptographic Mode Status). If the Mode is not set to FIPS 140-2, this is a finding.
Fix Text
From the DataPower command line, enter "use-fips on" to configure the network device to generate unique session identifiers using a FIPS 140-2 approved random number generator. From the web interface, use "Set Cryptographic Mode" (Administration >> Miscellaneous >> Crypto Tools, Set Cryptographic Mode tab) to set the appliance to "FIPS 140-2 Level 1" mode. This will achieve NIST SP800-131a compliance.
Additional Identifiers
Rule ID: SV-79799r1_rule
Vulnerability ID: V-65309
Group Title: SRG-NET-000510-ALG-000025
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-002450 |
The information system implements organization-defined cryptographic uses and type of cryptography required for each use in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. |
Controls
| Number | Title |
|---|---|
| SC-13 |
Cryptographic Protection |