STIGQter: STIG Summary: Ivanti Connect Secure NDM Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 01 Oct 2025:

The ICS must be configured to use DOD approved OCSP responders or CRLs to validate certificates used for PKI-based authentication.

DISA Rule

SV-258620r997515_rule

Vulnerability Number

V-258620

Group Title

SRG-APP-000175-NDM-000262

Rule Version

IVCS-NM-000500

Severity

CAT I

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-004068 - For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.

Weight

10

Fix Recommendation

In the ICS Web UI, navigate to System >> Configuration >> Certificates >> Trusted Client CAs.
1. Click the first DOD client CA.
2. Set the item to "Use OCSP with CRL fallback" under "Client certificate status checking".
3. Repeat these steps for every other client certificate CA.

Check Contents

In the ICS Web UI, navigate to System >> Configuration >> Certificates >> Trusted Client CAs.
1. Click the first DOD client CA.
2. Verify the item "Use OCSP with CRL fallback" is selected under the "Client certificate status checking" setting.
3. Check each other client certificate CA. Verify the setting "Use OCSP with CRL fallback" is selected.

If the ICS is not configured to use DOD approved OCSP responders or CRLs to validate certificates used for PKI-based authentication, this is a finding.

Vulnerability Number

V-258620

Documentable

False

Rule Version

IVCS-NM-000500

Severity Override Guidance

In the ICS Web UI, navigate to System >> Configuration >> Certificates >> Trusted Client CAs.
1. Click the first DOD client CA.
2. Verify the item "Use OCSP with CRL fallback" is selected under the "Client certificate status checking" setting.
3. Check each other client certificate CA. Verify the setting "Use OCSP with CRL fallback" is selected.

If the ICS is not configured to use DOD approved OCSP responders or CRLs to validate certificates used for PKI-based authentication, this is a finding.

Check Content Reference

M

Target Key

5558