STIGQter: STIG Summary: Application Layer Gateway Security Requirements Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The ALG providing user authentication intermediary services must transmit only encrypted representations of passwords.

DISA Rule

SV-205026r1207647_rule

Vulnerability Number

V-205026

Group Title

SRG-NET-000400

Rule Version

SRG-NET-000400-ALG-000097

Severity

CAT I

CCI(s)

• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.

Weight

10

Fix Recommendation

If user authentication intermediary services are provided, configure the ALG to transmit only encrypted representations of passwords.

Check Contents

If the ALG does not provide user authentication intermediary services, this is not applicable.

Verify the ALG transmits only encrypted representations of passwords.

If the ALG does not transmit only encrypted representations of passwords, this is a finding.

Vulnerability Number

V-205026

Documentable

False

Rule Version

SRG-NET-000400-ALG-000097

Severity Override Guidance

If the ALG does not provide user authentication intermediary services, this is not applicable.

Verify the ALG transmits only encrypted representations of passwords.

If the ALG does not transmit only encrypted representations of passwords, this is a finding.

Check Content Reference

M

Target Key

2904