STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025: STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:SV-274840r1143882_rule
V-274840
SRG-APP-000970
SRG-APP-000970-API-001660
CAT II
10
Build or configure the API to properly protect private keys used to sign assertions and tokens.
To check if the API protects the private keys used to sign assertions and tokens:
Verify private keys used for signing tokens and assertions are stored securely. These keys must not be hard coded in the codebase or stored in plaintext files.
Verify private keys are stored in a secure location such as a hardware security module (HSM) or key management service (KMS), which provides encryption and access control.
Verify only authorized personnel or systems can access the keys. Review filesystem permissions.
Verify that the private keys are encrypted both at rest and in transit. If using cloud-based key management systems, ensure that encryption is enabled by default.
Verify private keys are only used for their intended purpose—signing tokens and assertions.
Audit the system to ensure that keys are only accessible during token generation or signing processes and not left accessible longer than needed.
Confirm that there is a key rotation policy in place for the private keys used to sign tokens and assertions. These keys should be rotated regularly to reduce the risk of compromise.
Implement monitoring and logging mechanisms to audit any access to, or use of, private keys. Logs must capture who accessed the key, when, and for what purpose.
Review the API's or key management system's documentation to confirm private key protection practices align with industry standards, such as NIST guidelines and FIPS compliance.
If the API is not protecting private keys, this is a finding.
V-274840
False
SRG-APP-000970-API-001660
To check if the API protects the private keys used to sign assertions and tokens:
Verify private keys used for signing tokens and assertions are stored securely. These keys must not be hard coded in the codebase or stored in plaintext files.
Verify private keys are stored in a secure location such as a hardware security module (HSM) or key management service (KMS), which provides encryption and access control.
Verify only authorized personnel or systems can access the keys. Review filesystem permissions.
Verify that the private keys are encrypted both at rest and in transit. If using cloud-based key management systems, ensure that encryption is enabled by default.
Verify private keys are only used for their intended purpose—signing tokens and assertions.
Audit the system to ensure that keys are only accessible during token generation or signing processes and not left accessible longer than needed.
Confirm that there is a key rotation policy in place for the private keys used to sign tokens and assertions. These keys should be rotated regularly to reduce the risk of compromise.
Implement monitoring and logging mechanisms to audit any access to, or use of, private keys. Logs must capture who accessed the key, when, and for what purpose.
Review the API's or key management system's documentation to confirm private key protection practices align with industry standards, such as NIST guidelines and FIPS compliance.
If the API is not protecting private keys, this is a finding.
M
5703