STIGhub
STIGs
RMF Controls
Compare
← SC-23 — Session Authenticity
CCI-001184
Definition
Protect the authenticity of communications sessions.
Parent Control
SC-23
Session Authenticity
System and Communications Protection
Linked STIG Checks (126)
V-279067
CAT II
ColdFusion must be configured to mutually authenticate connecting proxies and load balancers.
Adobe ColdFusion Security Technical Implementation Guide
V-222971
CAT II
Tomcat servers must mutually authenticate proxy or load balancer connections.
Apache Tomcat Application Server 9 Security Technical Implementation Guide
V-204957
CAT II
The ALG must protect the authenticity of communications sessions.
Application Layer Gateway Security Requirements Guide
V-274600
CAT II
The API must protect Session IDs via encryption.
Application Programming Interface (API) Security Requirements Guide
V-222575
CAT II
The application must set the HTTPOnly flag on session cookies.
Application Security and Development Security Technical Implementation Guide
V-222576
CAT II
The application must set the secure flag on session cookies.
Application Security and Development Security Technical Implementation Guide
V-222577
CAT I
The application must not expose session IDs.
Application Security and Development Security Technical Implementation Guide
V-204762
CAT II
The application server must be configured to mutually authenticate connecting proxies, application servers or gateways.
Application Server Security Requirements Guide
V-237329
CAT I
The ArcGIS Server must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.
ArcGIS for Server 10.3 Security Technical Implementation Guide
V-272629
CAT I
CylanceON-PREM must be configured to use TLS 1.2 or higher.
Arctic Wolf CylanceON-PREM Security Technical Implementation Guide
V-276013
CAT I
Ax-OS must protect the authenticity of communications sessions.
Axonius Federal Systems Ax-OS Security Technical Implementation Guide
V-272417
CAT I
A BIND 9.x server implementation must maintain the integrity and confidentiality of DNS information while it is being prepared for transmission, in transmission, and in use and must perform integrity verification and data origin verification for all DNS information.
BIND 9.x Security Technical Implementation Guide
V-237372
CAT II
The CA API Gateway must protect the authenticity of communications sessions.
CA API Gateway ALG Security Technical Implementation Guide
V-272078
CAT II
The Cisco ACI must be configured to authenticate all routing protocol messages using a NIST-validated FIPS 198-1 message authentication code algorithm.
Cisco ACI Router Security Technical Implementation Guide
V-272082
CAT II
The Cisco ACI must be configured to implement message authentication and secure communications for all control plane protocols.
Cisco ACI Router Security Technical Implementation Guide
V-239959
CAT I
The Cisco ASA must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE) Phase 2.
Cisco ASA VPN Security Technical Implementation Guide
V-234565
CAT I
Citrix Delivery Controller must implement DoD-approved encryption.
Citrix Virtual Apps and Desktop 7.x Delivery Controller Security Technical Implementation Guide
V-234224
CAT II
Citrix License Server must protect the authenticity of communications sessions.
Citrix Virtual Apps and Desktop 7.x License Server Security Technical Implementation Guide
V-234257
CAT I
Citrix Linux Virtual Delivery Agent must implement DoD-approved encryption.
Citrix Virtual Apps and Desktop 7.x Linux Virtual Delivery Agent Security Technical Implementation Guide
V-234253
CAT I
Citrix Windows Virtual Delivery Agent must implement DoD-approved encryption.
Citrix Virtual Apps and Desktop 7.x Windows Virtual Delivery Agent Security Technical Implementation Guide
V-213202
CAT II
XenDesktop License Server must protect the authenticity of communications sessions.
Citrix XenDesktop 7.x License Server Security Technical Implementation Guide
V-213208
CAT I
Citrix Receiver must implement DoD-approved encryption.
Citrix XenDesktop 7.x Receiver Security Technical Implementation Guide
V-213213
CAT I
Citrix Windows Virtual Delivery Agent must implement DoD-approved encryption.
Citrix XenDesktop 7.x Windows VDA Security Technical Implementation Guide
V-233118
CAT I
The container platform must protect authenticity of communications sessions with the use of FIPS-validated 140-2 or 140-3 security requirements for cryptographic modules.
Container Platform Security Requirements Guide
V-269882
CAT II
The Dell OS10 Router must be configured to implement message authentication for all control plane protocols.
Dell OS10 Switch Router Security Technical Implementation Guide
V-269883
CAT II
The Dell OS10 BGP router must be configured to use a unique key for each autonomous system (AS) that it peers with.
Dell OS10 Switch Router Security Technical Implementation Guide
V-269884
CAT II
The Dell OS10 Router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.
Dell OS10 Switch Router Security Technical Implementation Guide
V-235776
CAT II
TCP socket binding for all Docker Engine - Enterprise nodes in a Universal Control Plane (UCP) cluster must be disabled.
Docker Enterprise 2.x Linux/UNIX Security Technical Implementation Guide
V-205182
CAT II
The DNS implementation must protect the authenticity of communications sessions for zone transfers.
Domain Name System (DNS) Security Requirements Guide
V-205183
CAT II
The DNS implementation must protect the authenticity of communications sessions for dynamic updates.
Domain Name System (DNS) Security Requirements Guide
V-205184
CAT II
The DNS implementation must protect the authenticity of communications sessions for queries.
Domain Name System (DNS) Security Requirements Guide
V-259968
CAT II
The Enterprise Voice, Video, and Messaging Endpoint must be configured to use FIPS-validated SHA-2 or higher to protect the authenticity of communications sessions.
Enterprise Voice, Video, and Messaging Endpoint Security Requirements Guide
V-260016
CAT I
The Enterprise Voice, Video, and Messaging Session Manager must be configured to use FIPS-validated SHA-2 or higher to protect the authenticity of communications sessions.
Enterprise Voice, Video, and Messaging Session Management Security Requirements Guide
V-260053
CAT II
The F5 BIG-IP appliance must not use the On-Demand Cert Auth VPE agent as part of the APM Policy Profiles.
F5 BIG-IP Access Policy Manager Security Technical Implementation Guide
V-260055
CAT III
The F5 BIG-IP appliance must be configured to limit authenticated client sessions to initial session source IP.
F5 BIG-IP Access Policy Manager Security Technical Implementation Guide
V-215766
CAT II
The BIG-IP Core implementation must be configured to protect the authenticity of communications sessions.
F5 BIG-IP Local Traffic Manager Security Technical Implementation Guide
V-266139
CAT I
The F5 BIG-IP appliance providing intermediary services for remote access must use FIPS-validated cryptographic algorithms, including TLS 1.2 at a minimum.
F5 BIG-IP TMOS ALG Security Technical Implementation Guide
V-266166
CAT II
The F5 BIG-IP appliance must not use the On-demand Cert Auth VPE agent as part of the APM Policy Profiles.
F5 BIG-IP TMOS ALG Security Technical Implementation Guide
V-266167
CAT II
The F5 BIG-IP appliance must be configured to restrict a consistent inbound IP for the entire management session.
F5 BIG-IP TMOS ALG Security Technical Implementation Guide
V-266168
CAT III
The F5 BIG-IP appliance must be configured to limit authenticated client sessions to initial session source IP.
F5 BIG-IP TMOS ALG Security Technical Implementation Guide
V-266174
CAT II
The VPN Gateway must use Always On VPN connections for remote computing.
F5 BIG-IP TMOS ALG Security Technical Implementation Guide
V-265982
CAT II
An authoritative name server must be configured to enable DNSSEC Resource Records.
F5 BIG-IP TMOS DNS Security Technical Implementation Guide
V-265990
CAT I
The F5 BIG-IP DNS implementation must protect the authenticity of communications sessions for zone transfers.
F5 BIG-IP TMOS DNS Security Technical Implementation Guide
V-266287
CAT I
The F5 BIG-IP appliance IPsec VPN must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE).
F5 BIG-IP TMOS VPN Security Technical Implementation Guide
V-278405
CAT II
NGINX must be configured to use FIPS-approved algorithms to protect the confidentiality and integrity of transmitted information.
F5 NGINX Security Technical Implementation Guide
V-266983
CAT II
AOS, when used as a VPN Gateway, must be configured to use IPsec with SHA-2 at 384 bits or greater for hashing to protect the integrity of remote access sessions.
HPE Aruba Networking AOS VPN Security Technical Implementation Guide
V-252615
CAT II
The IBM Aspera High-Speed Transfer Endpoint must be configured to protect the authenticity of communications sessions.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-252629
CAT II
The IBM Aspera High-Speed Transfer Server must be configured to protect the authenticity of communications sessions.
IBM Aspera Platform 4.2 Security Technical Implementation Guide
V-65233
CAT II
The DataPower Gateway must protect the authenticity of communications sessions.
IBM DataPower ALG Security Technical Implementation Guide
V-255804
CAT II
The MQ Appliance messaging server must ensure authentication of both SSH client and server during the entire session.
IBM MQ Appliance V9.0 AS Security Technical Implementation Guide
V-255865
CAT II
The WebSphere Application Server multifactor authentication for network access to privileged accounts must be used.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-255879
CAT II
The WebSphere Application Server DoD root CAs must be in the trust store.
IBM WebSphere Traditional V9.x Security Technical Implementation Guide
V-214174
CAT II
Infoblox DNS servers must protect the authenticity of communications sessions for zone transfers.
Infoblox 7.x DNS Security Technical Implementation Guide
V-214175
CAT II
Infoblox DNS servers must be configured to protect the authenticity of communications sessions for dynamic updates.
Infoblox 7.x DNS Security Technical Implementation Guide
V-214176
CAT II
Infoblox DNS servers must be configured to protect the authenticity of communications sessions for queries.
Infoblox 7.x DNS Security Technical Implementation Guide
V-233917
CAT II
Infoblox DNS service members must protect the authenticity of communications sessions for zone transfers when communicating with external DNS service members (i.e., DNS systems outside the Infoblox grid).
Infoblox 8.x DNS Security Technical Implementation Guide
V-233918
CAT II
Infoblox DNS service members must protect the authenticity of communications sessions for dynamic updates.
Infoblox 8.x DNS Security Technical Implementation Guide
V-233919
CAT II
Infoblox DNS service members must protect the authenticity of communications sessions for queries.
Infoblox 8.x DNS Security Technical Implementation Guide
V-66641
CAT I
The Juniper SRX Services Gateway VPN must configure Internet Key Exchange (IKE) with SHA1 or greater to protect the authenticity of communications sessions.
Juniper SRX SG VPN Security Technical Implementation Guide
V-214692
CAT I
The Juniper SRX Services Gateway VPN must configure Internet Key Exchange (IKE) with SHA1 or greater to protect the authenticity of communications sessions.
Juniper SRX Services Gateway VPN Security Technical Implementation Guide
V-242418
CAT II
The Kubernetes API server must use approved cipher suites.
Kubernetes Security Technical Implementation Guide
V-242419
CAT II
Kubernetes API Server must have the SSL Certificate Authority set.
Kubernetes Security Technical Implementation Guide
V-242420
CAT II
Kubernetes Kubelet must have the SSL Certificate Authority set.
Kubernetes Security Technical Implementation Guide
V-242421
CAT II
Kubernetes Controller Manager must have the SSL Certificate Authority set.
Kubernetes Security Technical Implementation Guide
V-242422
CAT II
Kubernetes API Server must have a certificate for communication.
Kubernetes Security Technical Implementation Guide
V-242423
CAT II
Kubernetes etcd must enable client authentication to secure service.
Kubernetes Security Technical Implementation Guide
V-242424
CAT II
Kubernetes Kubelet must enable tlsPrivateKeyFile for client authentication to secure service.
Kubernetes Security Technical Implementation Guide
V-242425
CAT II
Kubernetes Kubelet must enable tlsCertFile for client authentication to secure service.
Kubernetes Security Technical Implementation Guide
V-242426
CAT II
Kubernetes etcd must enable client authentication to secure service.
Kubernetes Security Technical Implementation Guide
V-242427
CAT II
Kubernetes etcd must have a key file for secure communication.
Kubernetes Security Technical Implementation Guide
V-242428
CAT II
Kubernetes etcd must have a certificate for communication.
Kubernetes Security Technical Implementation Guide
V-242429
CAT II
Kubernetes etcd must have the SSL Certificate Authority set.
Kubernetes Security Technical Implementation Guide
V-242430
CAT II
Kubernetes etcd must have a certificate for communication.
Kubernetes Security Technical Implementation Guide
V-242431
CAT II
Kubernetes etcd must have a key file for secure communication.
Kubernetes Security Technical Implementation Guide
V-242432
CAT II
Kubernetes etcd must have peer-cert-file set for secure communication.
Kubernetes Security Technical Implementation Guide
V-242433
CAT II
Kubernetes etcd must have a peer-key-file set for secure communication.
Kubernetes Security Technical Implementation Guide
V-225228
CAT II
Remoting Services HTTP channels must utilize authentication and encryption.
Microsoft DotNet Framework 4.0 Security Technical Implementation Guide
V-225237
CAT II
Remoting Services TCP channels must utilize authentication and encryption.
Microsoft DotNet Framework 4.0 Security Technical Implementation Guide
V-221218
CAT II
Exchange internal Send connectors must use domain security (mutual authentication Transport Layer Security).
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide
V-221219
CAT II
Exchange Internet-facing Receive connectors must offer Transport Layer Security (TLS) before using basic authentication.
Microsoft Exchange 2016 Edge Transport Server Security Technical Implementation Guide
V-228375
CAT II
Exchange internal Receive connectors must require encryption.
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide
V-259594
CAT II
Exchange internal send connectors must use domain security (mutual authentication Transport Layer Security).
Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide
V-259595
CAT II
Exchange internet-facing receive connectors must offer Transport Layer Security (TLS) before using basic authentication.
Microsoft Exchange 2019 Edge Server Security Technical Implementation Guide
V-259710
CAT I
The application must protect the confidentiality and integrity of transmitted information.
Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide
V-223027
CAT II
Logon options must be configured to prompt (Internet zone).
Microsoft Internet Explorer 11 Security Technical Implementation Guide
V-223070
CAT II
Logon options must be configured and enforced (Restricted Sites zone).
Microsoft Internet Explorer 11 Security Technical Implementation Guide
V-223344
CAT II
The SIP security mode in Lync must be enabled.
Microsoft Office 365 ProPlus Security Technical Implementation Guide
V-223345
CAT II
The HTTP fallback for SIP connection in Lync must be disabled.
Microsoft Office 365 ProPlus Security Technical Implementation Guide
V-238106
CAT II
Session Initiation Protocol (SIP) security mode must be configured.
Microsoft Skype for Business 2016 Security Technical Implementation Guide
V-238107
CAT II
In the event a secure Session Initiation Protocol (SIP) connection fails, the connection must be restricted from resorting to the unencrypted HTTP.
Microsoft Skype for Business 2016 Security Technical Implementation Guide
V-215626
CAT II
The Windows 2012 DNS Server must protect the authenticity of zone transfers via transaction signing.
Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide
V-215627
CAT I
The Windows 2012 DNS Server must protect the authenticity of dynamic updates via transaction signing.
Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide
V-215628
CAT II
The Windows 2012 DNS Server must protect the authenticity of query responses via DNSSEC.
Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide
V-259389
CAT II
The Windows DNS Server must protect the authenticity of zone transfers via transaction signing.
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide
V-259390
CAT I
The Windows DNS Server must protect the authenticity of dynamic updates via transaction signing.
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide
V-259391
CAT II
The Windows DNS Server must protect the authenticity of query responses via DNSSEC.
Microsoft Windows Server Domain Name System (DNS) Security Technical Implementation Guide
V-260908
CAT I
FIPS mode must be enabled.
Mirantis Kubernetes Engine Security Technical Implementation Guide
V-235984
CAT II
Oracle WebLogic must ensure authentication of both client and server during the entire session.
Oracle WebLogic Server 12c Security Technical Implementation Guide
V-273621
CAT II
The RUCKUS ICX router must be configured to implement message authentication for all control plane protocols.
RUCKUS ICX Router Security Technical Implementation Guide
V-273622
CAT II
The RUCKUS ICX BGP router must be configured to use a unique key for each autonomous system (AS) that it peers with.
RUCKUS ICX Router Security Technical Implementation Guide
V-273623
CAT II
The RUCKUS ICX router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.
RUCKUS ICX Router Security Technical Implementation Guide
V-254553
CAT I
Rancher RKE2 must protect authenticity of communications sessions with the use of FIPS-validated 140-2 or 140-3 security requirements for cryptographic modules.
Rancher Government Solutions RKE2 Security Technical Implementation Guide
V-257546
CAT I
OpenShift must protect authenticity of communications sessions with the use of FIPS-validated 140-2 or 140-3 validated cryptography.
Red Hat OpenShift Container Platform 4.12 Security Technical Implementation Guide
V-257546
CAT I
OpenShift must protect authenticity of communications sessions with the use of FIPS-validated 140-2 or 140-3 validated cryptography.
Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide
V-238508
CAT II
The Riverbed Optimization System (RiOS) must protect the authenticity of communications sessions by configuring securing pairing trusts for SSL and secure protocols.
Riverbed SteelHead CX v8 ALG Security Technical Implementation Guide
V-216982
CAT II
The router must be configured to implement message authentication for all control plane protocols.
Router Security Requirements Guide
V-216983
CAT II
The BGP router must be configured to use a unique key for each autonomous system (AS) that it peers with.
Router Security Requirements Guide
V-216984
CAT II
The router must be configured to use keys with a duration not exceeding 180 days for authenticating routing protocol messages.
Router Security Requirements Guide
V-254087
CAT I
Innoslate must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.
SPEC Innovations Innoslate 4.x Security Technical Implementation Guide
V-281376
CAT I
TCMax must protect the confidentiality and integrity of transmitted information.
Soaring Software Solutions TCMax 9.x Security Technical Implementation Guide
V-94311
CAT I
Symantec ProxySG must use Transport Layer Security (TLS) to protect the authenticity of communications sessions.
Symantec ProxySG ALG Security Technical Implementation Guide
V-240978
CAT II
The Tanium cryptographic signing capabilities must be enabled on the Tanium Clients, which will ensure the authenticity of communications sessions when answering requests from the Tanium Server.
Tanium 7.0 Security Technical Implementation Guide
V-241016
CAT II
The Tanium Server must protect the confidentiality and integrity of transmitted information with cryptographic signing capabilities enabled to ensure the authenticity of communications sessions when making requests from Tanium Clients.
Tanium 7.0 Security Technical Implementation Guide
V-234037
CAT II
The Tanium cryptographic signing capabilities must be enabled on the Tanium Clients to safeguard the authenticity of communications sessions when answering requests from the Tanium Server.
Tanium 7.3 Security Technical Implementation Guide
V-254903
CAT II
The Tanium cryptographic signing capabilities must be enabled on the Tanium Clients to safeguard the authenticity of communications sessions when answering requests from the Tanium Server.
Tanium 7.x Application on TanOS Security Technical Implementation Guide
V-253807
CAT II
The Tanium cryptographic signing capabilities must be enabled on the Tanium Clients to safeguard the authenticity of communications sessions when answering requests from the Tanium Server.
Tanium 7.x Security Technical Implementation Guide
V-234405
CAT II
The UEM server must protect the authenticity of communications sessions.
Unified Endpoint Management Server Security Requirements Guide
V-240943
CAT II
The vAMI must use sfcBasicPAMAuthentication for authentication of the remote administrator.
VMware vRealize Automation 7.x vAMI Security Technical Implementation Guide
V-256318
CAT I
The vCenter Server must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination using remote access.
VMware vSphere 7.0 vCenter Security Technical Implementation Guide
V-265978
CAT II
The vCenter Server must use DOD-approved encryption to protect the confidentiality of network sessions.
VMware vSphere 8.0 vCenter Security Technical Implementation Guide
V-207222
CAT II
The VPN Gateway must use FIPS 140-2 compliant mechanisms for authentication to a cryptographic module.
Virtual Private Network (VPN) Security Requirements Guide
V-207223
CAT I
The IPSec VPN must be configured to use FIPS-validated SHA-2 at 384 bits or higher for Internet Key Exchange (IKE).
Virtual Private Network (VPN) Security Requirements Guide
V-264336
CAT II
The VPN Gateway must use Always On VPN connections for remote computing.
Virtual Private Network (VPN) Security Requirements Guide
V-264360
CAT II
The web server must restrict a consistent inbound source IP for the entire management session.
Web Server Security Requirements Guide
V-264361
CAT II
The web server must restrict a consistent inbound source IP for the entire user session.
Web Server Security Requirements Guide
V-269573
CAT I
Xylok Security Suite must prevent access except through HTTPS.
Xylok Security Suite 20.x Security Technical Implementation Guide