STIGQter: STIG Summary: Ivanti Connect Secure VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 01 Oct 2025:

The ICS must be configured to use TLS 1.2, at a minimum.

DISA Rule

SV-258586r997505_rule

Vulnerability Number

V-258586

Group Title

SRG-NET-000062-VPN-000200

Rule Version

IVCS-VN-000060

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.
• CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.
• CCI-004891 - Implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Weight

10

Fix Recommendation

Configure the ICS to uses TLS 1.2 to protect remote access transmissions.

In the ICS Web UI, navigate to System >> Configuration >> Inbound SSL Options.
1. Under Allowed SSL and TLS Version, check the box for "Accept only TLS 1.2 (maximize security)".
2. Click "Save Changes".
3. Click "Proceed" for acceptance of Cipher Change.

Navigate to System >> Configuration >> Outbound SSL Options.
1. Under Allowed SSL and TLS Version, check the box for "Accept only TLS 1.2 (maximize security)".
2. Click "Save Changes".
3. Click "Proceed" for acceptance of Cipher Change.

Check Contents

Determine if the ICS uses TLS 1.2 to protect remote access transmissions.

In the ICS Web UI, navigate to System >> Configuration >> Inbound SSL Options.
1. Under Allowed SSL and TLS Version, verify "Accept only TLS 1.2 (maximize security)" is checked.
2. Navigate to System >> Configuration >> Outbound SSL Options.
3. Under Allowed SSL and TLS Version, verify "Accept only TLS 1.2 (maximize security)" is checked.

If the ICS does not use TLS 1.2, at a minimum, this is a finding.

Vulnerability Number

V-258586

Documentable

False

Rule Version

IVCS-VN-000060

Severity Override Guidance

Determine if the ICS uses TLS 1.2 to protect remote access transmissions.

In the ICS Web UI, navigate to System >> Configuration >> Inbound SSL Options.
1. Under Allowed SSL and TLS Version, verify "Accept only TLS 1.2 (maximize security)" is checked.
2. Navigate to System >> Configuration >> Outbound SSL Options.
3. Under Allowed SSL and TLS Version, verify "Accept only TLS 1.2 (maximize security)" is checked.

If the ICS does not use TLS 1.2, at a minimum, this is a finding.

Check Content Reference

M

Target Key

5559