STIGQter: STIG Summary: SPEC Innovations Innoslate 4.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 08 Sep 2022:

Innoslate must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.

DISA Rule

SV-254087r845265_rule

Vulnerability Number

V-254087

Group Title

SRG-APP-000014

Rule Version

SPEC-IN-000030

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
• CCI-001184 - Protect the authenticity of communications sessions.
• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.
• CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
• CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.

Weight

10

Fix Recommendation

1. Open the server.xml file inside the conf folder of the tomcat installation (IE "C:\Innoslate4\apache-tomcat\conf" or "$CATALINA_BASE/conf/server.xml"). Add a connector tag for HTTPS scheme with PORT 8443 (or other AO-approved port) using the following example:

Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLSv1.2"
keystoreFile="C:\Innoslate4\apache-tomcat-8.5.30\conf\keystore.jks"
keystorePass="123456"
keyAlias="tomcatssl"
/

2. Set "port" to 8443, or other AO-approved port.
Set "protocol" to "org.apache.coyote.http11.Http11NioProtocol".
Set "SSLEnabled" to "true".
Set "scheme" to "https".
Set "secure" to "true".
Set "SSLProtocol" or "SSLEnabledProtocols" to "TLSv1.2". The name of this flag varies with Tomcat versions.
Set "keystoreFile" to the path of the keystore utilized by the system, and set the associated password with "keystorePass".

3. Save the server.xml file.

Check Contents

1. Consult the System Administrator if needed to determine the location of the Apache Tomcat server.xml file and the network port that was specified during installation for use with Innoslate. The default is 8443; other AO-approved ports may be used.
2. Open the server.xml file with a text editor, and locate the <Connector/> element. The following is an example:

Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" SSLProtocol="TLSv1.2"
keystoreFile="$keystorepath"
keystorePass="123456"
keyAlias="tomcatssl"
/

If "port" is not set to 8443, or other AO-approved port, this is a finding.
If "protocol" is not set to "org.apache.coyote.http11.Http11NioProtocol", this is a finding.
If "SSLEnabled" is not set to "true", this is a finding.
If "scheme" is not set to "https", this is a finding.
If "secure" is not set to "true", this is a finding.
If "SSLProtocol"or "SSLEnabledProtocols" is not set to "TLSv1.2", this is a finding. The name of this flag varies with Tomcat versions.

Vulnerability Number

V-254087

Documentable

False

Rule Version

SPEC-IN-000030

Severity Override Guidance

1. Consult the System Administrator if needed to determine the location of the Apache Tomcat server.xml file and the network port that was specified during installation for use with Innoslate. The default is 8443; other AO-approved ports may be used.
2. Open the server.xml file with a text editor, and locate the <Connector/> element. The following is an example:

Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" SSLProtocol="TLSv1.2"
keystoreFile="$keystorepath"
keystorePass="123456"
keyAlias="tomcatssl"
/

If "port" is not set to 8443, or other AO-approved port, this is a finding.
If "protocol" is not set to "org.apache.coyote.http11.Http11NioProtocol", this is a finding.
If "SSLEnabled" is not set to "true", this is a finding.
If "scheme" is not set to "https", this is a finding.
If "secure" is not set to "true", this is a finding.
If "SSLProtocol"or "SSLEnabledProtocols" is not set to "TLSv1.2", this is a finding. The name of this flag varies with Tomcat versions.

Check Content Reference

M

Target Key

5481