STIGQter STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The API must provide protected storage for API keys.

DISA Rule

SV-274830r1143869_rule

Vulnerability Number

V-274830

Group Title

SRG-APP-000915

Rule Version

SRG-APP-000915-API-001610

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Build or configure the API to provide protected storage using cryptographic mechanisms that comply with NIST-approved algorithms and key management standards (e.g., AES-256, FIPS 140-3 validated modules) for API keys.

Check Contents

Verify the API is configured to provide protected storage for API keys, ensuring they are encrypted at rest using cryptographic mechanisms that comply with NIST-approved algorithms and key management standards (e.g., AES-256, FIPS 140-3 validated modules). Protected storage must prevent unauthorized access, tampering, or disclosure of keys, and must enforce access controls consistent with the principle of least privilege. This includes storing keys in secure vaults, hardware security modules (HSMs), or encrypted databases.

If the API is not configured to provide protected storage for API keys, this is a finding.

Vulnerability Number

V-274830

Documentable

False

Rule Version

SRG-APP-000915-API-001610

Severity Override Guidance

Verify the API is configured to provide protected storage for API keys, ensuring they are encrypted at rest using cryptographic mechanisms that comply with NIST-approved algorithms and key management standards (e.g., AES-256, FIPS 140-3 validated modules). Protected storage must prevent unauthorized access, tampering, or disclosure of keys, and must enforce access controls consistent with the principle of least privilege. This includes storing keys in secure vaults, hardware security modules (HSMs), or encrypted databases.

If the API is not configured to provide protected storage for API keys, this is a finding.

Check Content Reference

M

Target Key

5703