V-38743

Discussion

VPNs are vulnerable to attack if they are not supported by strong authentication. An adversary may be able gain access to network resources and sensitive information if they can compromise the authentication process. Common Access Card (CAC) authentication is a strong cryptographic two-factor authentication that greatly mitigates the risk of VPN authentication breaches. Other DoD approved PKI mechanisms provide similar levels of assurance.

Check Content

Navigate to "Options -> Security -> VPN -> <VPN Profile>" and ensure "Authentication Type" is set to "PKI" or "XAUTH-PKI", and greyed out. Otherwise, this is a finding.