| Checked | Name | Title |
|---|
| ☐ | SV-251008r1028171_rule | The Sentry must enforce approved authorizations for logical access to information and system resources by enabling identity-based, role-based, and/or attribute-based security policies. These controls are enabled in MobileIron UEM (MobileIron Core) and applied by the Sentry for conditional access enforcement. |
| ☐ | SV-251009r1028172_rule | The Sentry must enforce approved authorizations for controlling the flow of information within the network based on attribute-based inspection of the source, destination, and headers, of the communications traffic. |
| ☐ | SV-251010r1028173_rule | The Sentry must restrict or block harmful or suspicious communications traffic by controlling the flow of information between interconnected networks based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic. |
| ☐ | SV-251011r1028175_rule | The Sentry providing intermediary services for remote access communications traffic must use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions. |
| ☐ | SV-251012r1028177_rule | If Sentry stores secret or private keys, it must use FIPS-approved key management technology and processes in the production and control of private/secret cryptographic keys. |
| ☐ | SV-251013r1028178_rule | The Sentry that provides intermediary services for TLS must be configured to comply with the required TLS settings in NIST SP 800-52. |
| ☐ | SV-251014r1028180_rule | The Sentry providing intermediary services for remote access communications traffic must use NIST FIPS-validated cryptography to protect the integrity of remote access sessions. |
| ☐ | SV-251015r1028181_rule | The Sentry must produce audit records containing information to establish what type of events occurred. |
| ☐ | SV-251016r1028182_rule | The Sentry must produce audit records containing information to establish when (date and time) the events occurred. |
| ☐ | SV-251017r1028183_rule | The Sentry must produce audit records containing information to establish where the events occurred. |
| ☐ | SV-251018r1028184_rule | The Sentry must produce audit records containing information to establish the source of the events. |
| ☐ | SV-251019r1028185_rule | The Sentry must produce audit records containing information to establish the outcome of the events. |
| ☐ | SV-251020r1028186_rule | The Sentry must generate audit records containing information to establish the identity of any individual or process associated with the event. |
| ☐ | SV-251021r1028187_rule | The Sentry must send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs. |
| ☐ | SV-251022r1028188_rule | The Sentry must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments. |
| ☐ | SV-251023r1028189_rule | The Sentry providing mobile device access control intermediary services must be configured with a pre-established trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) which validate mobile device account access authorizations and privileges. |
| ☐ | SV-251024r1028190_rule | The Sentry providing mobile device authentication intermediary services must restrict mobile device authentication traffic to specific authentication server(s). |
| ☐ | SV-251025r1028191_rule | The Sentry providing mobile device authentication intermediary services must use multifactor authentication for network access to non-privileged accounts. |
| ☐ | SV-251026r1029565_rule | The Sentry providing mobile device authentication intermediary services must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts. |
| ☐ | SV-251027r1028193_rule | The Sentry that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation. |
| ☐ | SV-251028r1028194_rule | The Sentry providing PKI-based mobile device authentication intermediary services must map authenticated identities to the mobile device account. |
| ☐ | SV-251029r1028195_rule | The Sentry must terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for mobile device sessions (non-privileged session), the session must be terminated after 15 minutes of inactivity. |
| ☐ | SV-251030r1028196_rule | The Sentry must offload audit records onto a centralized log server. |
| ☐ | SV-251031r1029566_rule | The Sentry providing mobile device authentication intermediary services must implement multifactor authentication for remote access to nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access. |
| ☐ | SV-251032r1028198_rule | The Sentry providing mobile device authentication intermediary services using PKI-based mobile device authentication must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of protected sessions. |
| ☐ | SV-251033r1028199_rule | The Sentry must implement load balancing to limit the effects of known and unknown types of Denial-of-Service (DoS) attacks. |
| ☐ | SV-251034r1028200_rule | The Sentry must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations. |
| ☐ | SV-251035r1028201_rule | The Sentry must reveal error messages only to the ISSO, ISSM, and SCA. |
| ☐ | SV-251036r1028203_rule | The Sentry providing encryption intermediary services must implement NIST FIPS-validated cryptography to generate cryptographic hashes. |
| ☐ | SV-251037r1028205_rule | The Sentry providing encryption intermediary services must implement NIST FIPS-validated cryptography for digital signatures. |
| ☐ | SV-251038r1028207_rule | The Sentry providing encryption intermediary services must use NIST FIPS-validated cryptography to implement encryption services. |
| ☐ | SV-251039r1028208_rule | The Sentry must offload audit records onto a centralized log server in real time. |
STIGQter: STIG Summary: