STIGQter: STIG Summary: AvePoint DocAve 6 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 24 Aug 2022:

DocAve must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.

DISA Rule

SV-253512r836511_rule

Vulnerability Number

V-253512

Group Title

SRG-APP-000014

Rule Version

DCAV-00-000006

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.

Weight

10

Fix Recommendation

Consult the Microsoft documentation and ensure the .Net Framework on DocAve servers uses a version that supports TLS 1.2. Update if necessary.

Configure the DocAve servers to enable TLS 1.2 protocol only:
- On the DocAve servers, open Registry Editor.
- Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
- Disable TLS 1.0, TLS 1.1, and any SSL protocols if present.

Configure the DocAve servers to enable strong cryptography setting.
- On the DocAve servers, open Registry Editor.
- Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 and verify:
"SystemDefaultTlsVersions" = dword:00000001
"SchUseStrongCrypto" = dword:00000001

Check Contents

Check the .Net Framework version on DocAve servers.
- On the servers where DocAve is installed, open Registry Editor.
- Refer to the official Microsoft document to verify the .Net Framework version supports TLS 1.2. The official Microsoft Document URL is: https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client#bkmk_net.
- .NET Framework 4.6.2 or later supports TLS 1.2 inherently.

If the .Net Framework version doesn't support TLS 1.2, this is a finding.

Check that DocAve servers only have TLS 1.2 protocol enabled.
- On the DocAve servers, open Registry Editor.
- Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
- Verify TLS 1.0, TLS 1.1, and any SSL protocols are not enabled.

If TLS 1.0, TLS 1.1, or any SSL protocols are enabled, this is a finding.

Check that DocAve servers have strong cryptography setting enabled.
- On the DocAve servers, open Registry Editor.
- Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319.
- Verify "SystemDefaultTlsVersions" = dword:00000001 and "SchUseStrongCrypto" = dword:00000001, otherwise this is a finding.

Vulnerability Number

V-253512

Documentable

False

Rule Version

DCAV-00-000006

Severity Override Guidance

Check the .Net Framework version on DocAve servers.
- On the servers where DocAve is installed, open Registry Editor.
- Refer to the official Microsoft document to verify the .Net Framework version supports TLS 1.2. The official Microsoft Document URL is: https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client#bkmk_net.
- .NET Framework 4.6.2 or later supports TLS 1.2 inherently.

If the .Net Framework version doesn't support TLS 1.2, this is a finding.

Check that DocAve servers only have TLS 1.2 protocol enabled.
- On the DocAve servers, open Registry Editor.
- Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols.
- Verify TLS 1.0, TLS 1.1, and any SSL protocols are not enabled.

If TLS 1.0, TLS 1.1, or any SSL protocols are enabled, this is a finding.

Check that DocAve servers have strong cryptography setting enabled.
- On the DocAve servers, open Registry Editor.
- Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319.
- Verify "SystemDefaultTlsVersions" = dword:00000001 and "SchUseStrongCrypto" = dword:00000001, otherwise this is a finding.

Check Content Reference

M

Target Key

5472