STIGhubSTIGhub
STIGsSearchCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 6 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

IBM Aspera Platform 4.2 Security Technical Implementation Guide

Version

V1R3

Release Date

Dec 5, 2024

SCAP Benchmark ID

IBM_Aspera_Platform_4-2_STIG

Total Checks

95

Tags

other
CAT I: 11CAT II: 82CAT III: 2

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (95)

V-252556MEDIUMThe IBM Aspera Platform must be configured to support centralized management and configuration.V-252557MEDIUMThe IBM Aspera Platform must not have unnecessary services and functions enabled.V-252558MEDIUMIBM Aspera Console must implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.V-252559MEDIUMThe IBM Aspera Console must protect audit information from unauthorized read access.V-252560MEDIUMThe IBM Aspera Console must protect audit tools from unauthorized access.V-252561MEDIUMIBM Aspera Console must be configured with a preestablished trust relationship and mechanisms with appropriate authorities (e.g., Active Directory or AAA server) which validate user account access authorizations and privileges.V-252562HIGHThe IBM Aspera Console feature must be configured to use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.V-252563MEDIUMIBM Aspera Console interactive session must be terminated after 10 minutes of inactivity for non-privileged and privileged sessions.V-252564MEDIUMIBM Aspera Console must enforce password complexity by requiring at least fifteen characters, with at least one upper case letter, one lower case letter, one number, and one symbol.V-252565MEDIUMIBM Aspera Console must lock accounts after three unsuccessful login attempts within a 15-minute timeframe.V-252566MEDIUMIBM Aspera Console must prevent concurrent logins for all accounts.V-252567MEDIUMIBM Aspera Console passwords must be prohibited from reuse for a minimum of five generations.V-252568MEDIUMIBM Aspera Console user account passwords must have a 60-day maximum password lifetime restriction.V-252569MEDIUMThe IBM Aspera Console must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.V-252570HIGHThe IBM Aspera Console must be configured to use NIST FIPS-validated cryptography to protect the integrity of file transfers.V-252571MEDIUMThe IBM Aspera Console private/secret cryptographic keys file must be group-owned by root to prevent unauthorized read access.V-252572MEDIUMThe IBM Aspera Console private/secret cryptographic keys file must be owned by root to prevent unauthorized read access.V-252573MEDIUMThe IBM Aspera Console private/secret cryptographic keys file must have a mode of 0600 or less permissive to prevent unauthorized read access.V-252574MEDIUMThe IBM Aspera Console feature audit tools must be protected from unauthorized modification or deletion.V-252575MEDIUMIBM Aspera Faspex interactive session must be terminated after 10 minutes of inactivity for non-privileged and privileged sessions.V-252576MEDIUMThe IBM Aspera Faspex private/secret cryptographic keys file must have a mode of 0600 or less permissive to prevent unauthorized read access.V-252577MEDIUMIBM Aspera Faspex must allow the use of a temporary password for logins with an immediate change to a permanent password.V-252578LOWIBM Aspera Faspex must be configured to display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.V-252579MEDIUMIBM Aspera Faspex must disable account identifiers after 35 days of inactivity.V-252580MEDIUMIBM Aspera Faspex must implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.V-252581MEDIUMIBM Aspera Faspex must lock accounts after three unsuccessful login attempts within a 15-minute timeframe.V-252582MEDIUMIBM Aspera Faspex must prevent concurrent logins for all accounts.V-252583MEDIUMIBM Aspera Faspex must require password complexity features to be enabled.V-252584MEDIUMIBM Aspera Faspex must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).V-252585MEDIUMIBM Aspera Faspex passwords must be prohibited from reuse for a minimum of five generations.V-252586MEDIUMIBM Aspera Faspex user account passwords must have a 60-day maximum password lifetime restriction.V-252587HIGHThe IBM Aspera Faspex feature must be configured to use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.V-252588MEDIUMIBM Aspera Faspex must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.V-252589MEDIUMIBM Aspera Faspex must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).V-252590HIGHIBM Aspera Faspex must be configured to use NIST FIPS-validated cryptography to protect the integrity of file transfers.V-252591MEDIUMIBM Aspera Faspex must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.V-252592MEDIUMIBM Aspera Faspex must protect audit information from unauthorized modification.V-252593MEDIUMThe IBM Aspera Faspex private/secret cryptographic keys file must be group-owned by faspex to prevent unauthorized read access.V-252594MEDIUMThe IBM Aspera Faspex private/secret cryptographic keys file must be owned by faspex to prevent unauthorized read access.V-252595MEDIUMThe IBM Aspera Faspex Server must restrict users from using transfer services by default.V-252596MEDIUMThe IBM Aspera Faspex Server must restrict users read, write, and browse permissions by default.V-252597MEDIUMThe IBM Aspera Shares interactive session must be terminated after 10 minutes of inactivity for non-privileged and privileged sessions.V-252598LOWIBM Aspera Shares must be configured to display the Standard Mandatory DoD-approved Notice and Consent Banner before granting access to the system.V-252599MEDIUMIBM Aspera Shares must implement multifactor authentication for remote access to non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.V-252600MEDIUMIBM Aspera Shares must lock accounts after three unsuccessful login attempts within a 15-minute timeframe.V-252601MEDIUMIBM Aspera Shares must require password complexity features to be enabled.V-252602MEDIUMIBM Aspera Shares must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).V-252603MEDIUMIBM Aspera Shares user account passwords must have a 60-day maximum password lifetime restriction.V-252604HIGHThe IBM Aspera Shares feature must be configured to use encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.V-252605MEDIUMIBM Aspera Shares must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.V-252606MEDIUMIBM Aspera Shares must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).V-252607HIGHIBM Aspera Shares feature must be configured to use NIST FIPS-validated cryptography to protect the integrity of file transfers.V-252608MEDIUMIBM Aspera Shares must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection.V-252609MEDIUMIBM Aspera Shares must protect audit information from unauthorized deletion.V-252610MEDIUMThe IBM Aspera Shares private/secret cryptographic keys file must be group-owned by nobody to prevent unauthorized read access.V-252611MEDIUMThe IBM Aspera Shares private/secret cryptographic keys file must be owned by nobody to prevent unauthorized read access.V-252612MEDIUMThe IBM Aspera Shares private/secret cryptographic keys file must have a mode of 0400 or less permissive to prevent unauthorized read access.V-252613HIGHThe IBM Aspera High-Speed Transfer Endpoint must be configured to comply with the required TLS settings in NIST SP 800-52.V-252614MEDIUMThe IBM Aspera High-Speed Transfer Endpoint must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.V-252615MEDIUMThe IBM Aspera High-Speed Transfer Endpoint must be configured to protect the authenticity of communications sessions.V-252616HIGHThe IBM Aspera High-Speed Transfer Endpoint must be configured to use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.V-252617MEDIUMThe IBM Aspera High-Speed Transfer Endpoint must enable content protection for each transfer user by encrypting passphrases used for server-side encryption at rest (SSEAR).V-252618MEDIUMThe IBM Aspera High-Speed Transfer Endpoint must enable password protection of the node database.V-252619MEDIUMThe IBM Aspera High-Speed Transfer Endpoint must have a master-key set to encrypt the dynamic token encryption key.V-252620MEDIUMThe IBM Aspera High-Speed Transfer Endpoint must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.V-252621MEDIUMThe IBM Aspera High-Speed Transfer Endpoint must not store group content-protection secrets in plain text.V-252622MEDIUMThe IBM Aspera High-Speed Transfer Endpoint must not store node content-protection secrets in plain text.V-252623MEDIUMThe IBM Aspera High-Speed Transfer Endpoint must not store user content-protection secrets in plain text.V-252624MEDIUMThe IBM Aspera High-Speed Transfer Endpoint must restrict users from using transfer services by default.V-252625MEDIUMThe IBM Aspera High-Speed Transfer Endpoint must restrict users read, write, and browse permissions by default.V-252626MEDIUMThe IBM Aspera High-Speed Transfer Endpoint must prohibit the use of cached authenticators after an organization-defined time period.V-252627HIGHThe IBM Aspera High-Speed Transfer Server must be configured to comply with the required TLS settings in NIST SP 800-52.V-252628MEDIUMThe IBM Aspera High-Speed Transfer Server must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.V-252629MEDIUMThe IBM Aspera High-Speed Transfer Server must be configured to protect the authenticity of communications sessions.V-252630HIGHThe IBM Aspera High-Speed Transfer Server must be configured to use NIST FIPS-validated cryptography to protect the integrity of remote access sessions.V-252631MEDIUMThe IBM Aspera High-Speed Transfer Server must configure the SELinux context type to allow the "aspshell".V-252632MEDIUMThe IBM Aspera High-Speed Transfer Server must enable content protection for each transfer user by encrypting passphrases used for server-side encryption at rest (SSEAR).V-252633MEDIUMThe IBM Aspera High-Speed Transfer Server must enable password protection of the node database.V-252634MEDIUMThe IBM Aspera High-Speed Transfer Server must enable the use of dynamic token encryption keys.V-252635MEDIUMThe IBM Aspera High-Speed Transfer Server must have a master-key set to encrypt the dynamic token encryption key.V-252636MEDIUMThe IBM Aspera High-Speed Transfer Server must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.V-252637MEDIUMThe IBM Aspera High-Speed Transfer Server must not store group content-protection secrets in plain text.V-252638MEDIUMThe IBM Aspera High-Speed Transfer Server must not store node content-protection secrets in plain text.V-252639MEDIUMThe IBM Aspera High-Speed Transfer Server must not store user content-protection secrets in plain text.V-252640MEDIUMThe IBM Aspera High-Speed Transfer Server must not use the root account for transfers.V-252641MEDIUMThe IBM Aspera High-Speed Transfer Server must restrict Aspera transfer users to a limited part of the server's file system.V-252642MEDIUMThe IBM Aspera High-Speed Transfer Server must restrict the transfer user(s) to the "aspshell".V-252643MEDIUMThe IBM Aspera High-Speed Transfer Server must restrict users from using transfer services by default.V-252644MEDIUMThe IBM Aspera High-Speed Transfer Server must restrict users read, write, and browse permissions by default.V-252645MEDIUMThe IBM Aspera High-Speed Transfer Server must set the default docroot to an empty folder.V-252646MEDIUMThe IBM Aspera High-Speed Transfer Server private/secret cryptographic keys file must be group-owned by root to prevent unauthorized read access.V-252647MEDIUMThe IBM Aspera High-Speed Transfer Server private/secret cryptographic keys file must be owned by root to prevent unauthorized read access.V-252648MEDIUMThe IBM Aspera High-Speed Transfer Server private/secret cryptographic keys file must have a mode of 0600 or less permissive to prevent unauthorized read access.V-252649MEDIUMThe IBM Aspera High-Speed Transfer Server must prohibit the use of cached authenticators after an organization-defined time period.V-269982HIGHThe IBM Aspera Console feature must be a version supported by the vendor.