Title

Unencrypted remote access to system services must not be permitted. (Cat I impact)

Discussion

Unencrypted access to system services may permit user identification and passwords that are being transmitted in clear text to be intercepted. This could provide an intruder access to the network.

Check Content

Verify encryption is required for remote access. If userid and password information are not encrypted, this is a finding. If administrator data is not encrypted, this is a finding. If user data coming from or going outside the enclave is not encrypted, this is a finding.

Fix Text

Require encryption for remote access. Encryption of userid and password information is always required. Encryption of administrator data is always required. Encryption of user data coming from or going outside the network firewall is required. Encryption of the user data inside the network firewall is also highly recommended.

Additional Identifiers

Rule ID:

Vulnerability ID: V-2908

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.