STIGQter: STIG Summary: Ivanti Sentry 9.x ALG Security Technical Implementation Guide Version: 3 Release: 1 Benchmark Date: 24 Oct 2024:

The Sentry providing mobile device authentication intermediary services must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.

DISA Rule

SV-251026r1029565_rule

Vulnerability Number

V-251026

Group Title

SRG-NET-000147-ALG-000095

Rule Version

MOIS-AL-000410

Severity

CAT II

CCI(s)

• CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.

Weight

10

Fix Recommendation

The Sentry is configured with TLS by default. To configure the Sentry with TLS 1.2:

1. Log in to Sentry.
2. Go to Settings >> Services >> Sentry.
3. Select each of the configurations listed below and follow steps 4 and 5:
a. Incoming SSL configuration
b. Outgoing SSL configuration
c. UEM SSL Configuration
d. Access SSL Configuration
4. In protocols, make TLS 1.2 enabled.
5. Apply the configuration and click "Save" in the top right corner.

Check Contents

The Sentry is configured with TLS by default. The Sentry enables TLS 1.2 by default. To check the status:

1. Log in to Sentry.
2. Go to Settings >> Services >> Sentry.
3. For each of the following configurations, follow step 4:
a. Incoming SSL configuration
b. Outgoing SSL configuration
c. UEM SSL configuration
d. Access SSL configuration
4. In Protocols, verify TLS 1.2 is enabled.

If TLS 1.2 is not enabled for each configuration, this is a finding.

For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the main section "Standalone Sentry Settings", which includes subsections on how TLS 1.2 is set as the default protocol:
1. Incoming SSL configuration
2. Outgoing SSL configuration
3. UEM SSL configuration
4. Access SSL configuration

Sentry conforms to the NIST SP 800-52 TLS settings by setting TLS 1.2 by default.

Vulnerability Number

V-251026

Documentable

False

Rule Version

MOIS-AL-000410

Severity Override Guidance

The Sentry is configured with TLS by default. The Sentry enables TLS 1.2 by default. To check the status:

1. Log in to Sentry.
2. Go to Settings >> Services >> Sentry.
3. For each of the following configurations, follow step 4:
a. Incoming SSL configuration
b. Outgoing SSL configuration
c. UEM SSL configuration
d. Access SSL configuration
4. In Protocols, verify TLS 1.2 is enabled.

If TLS 1.2 is not enabled for each configuration, this is a finding.

For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the main section "Standalone Sentry Settings", which includes subsections on how TLS 1.2 is set as the default protocol:
1. Incoming SSL configuration
2. Outgoing SSL configuration
3. UEM SSL configuration
4. Access SSL configuration

Sentry conforms to the NIST SP 800-52 TLS settings by setting TLS 1.2 by default.

Check Content Reference

M

Target Key

5439