STIGQter: STIG Summary: Ivanti Sentry 9.x ALG Security Technical Implementation Guide Version: 3 Release: 1 Benchmark Date: 24 Oct 2024:

The Sentry that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.

DISA Rule

SV-251027r1028193_rule

Vulnerability Number

V-251027

Group Title

SRG-NET-000164-ALG-000100

Rule Version

MOIS-AL-000420

Severity

CAT II

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.

Weight

10

Fix Recommendation

The Sentry is configured with TLS by default. To configure the Sentry with TLS 1.2:

1. Log in to Sentry.
2. Go to Settings >> Services >> Sentry.
3. Select each of the configurations listed below and follow steps 4 and 5:
a. Incoming SSL configuration
b. Outgoing SSL configuration
c. UEM SSL Configuration
d. Access SSL Configuration
4. In protocols, make TLS 1.2 enabled.
5. Apply the configuration and click "Save" in the top right corner.

Check Contents

The Sentry is configured with TLS by default. The Sentry enables TLS 1.2 by default. To check the status:

1. Log in to Sentry.
2. Go to Settings >> Services >> Sentry.
3. For each of the following configurations, follow step 4:
a. Incoming SSL configuration
b. Outgoing SSL configuration
c. UEM SSL configuration
d. Access SSL configuration
4. In Protocols, verify TLS 1.2 is enabled.

If TLS 1.2 is not enabled for each configuration, this is a finding.

For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the main section "Standalone Sentry Settings", which includes subsections on how TLS 1.2 is set as the default protocol:
1. Incoming SSL configuration
2. Outgoing SSL configuration
3. UEM SSL configuration
4. Access SSL configuration

Sentry conforms to the NIST SP 800-52 TLS settings by setting TLS 1.2 by default.

Vulnerability Number

V-251027

Documentable

False

Rule Version

MOIS-AL-000420

Severity Override Guidance

The Sentry is configured with TLS by default. The Sentry enables TLS 1.2 by default. To check the status:

1. Log in to Sentry.
2. Go to Settings >> Services >> Sentry.
3. For each of the following configurations, follow step 4:
a. Incoming SSL configuration
b. Outgoing SSL configuration
c. UEM SSL configuration
d. Access SSL configuration
4. In Protocols, verify TLS 1.2 is enabled.

If TLS 1.2 is not enabled for each configuration, this is a finding.

For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the main section "Standalone Sentry Settings", which includes subsections on how TLS 1.2 is set as the default protocol:
1. Incoming SSL configuration
2. Outgoing SSL configuration
3. UEM SSL configuration
4. Access SSL configuration

Sentry conforms to the NIST SP 800-52 TLS settings by setting TLS 1.2 by default.

Check Content Reference

M

Target Key

5439