V-215207

Discussion

Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive and tape drive, when used for backups) within an operating system. This requirement addresses protection of user-generated data, as well as operating system-specific configuration data. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate, in accordance with the security category and/or classification of the information.

Check Content

If the organization does not require to encrypt the data at rest this is Not Applicable.

Check if the "clic.rte" fileset is installed:
# lslpp -l |grep clic

The above command should yield the following output:
  clic.rte.kernext          4.10.0.1  COMMITTED  CryptoLite for C Kernel
  clic.rte.lib                     4.10.0.1  COMMITTED  CryptoLite for C Library
  clic.rte.kernext          4.10.0.1  COMMITTED  CryptoLite for C Kernel

If the "clic.rte" fileset is not installed, this is a finding.

To check if a JFS2 file system (mounted as /fs2_mnt) is EFS-enabled, use the following command:

# lsfs -q /fs2_mnt

Name            Nodename   Mount Pt               VFS   Size    Options    Auto Accounting
/dev/fslv00     --         /fs2_mnt                   jfs2  262144  --         no   no 
  (lv size: 262144, fs size: 262144, block size: 4096, sparse files: yes, inline log: no, inline log size: 0, EAformat: v2, Quota: no, DMAPI: no, VIX: yes, EFS: no, ISNAPSHOT: no, MAXEXT: 0, MountGuard: no)

If the above command shows "EFS: no", this is a finding.