{"stig":{"title":"Omnissa Horizon Unified Access Gateway (UAG) Security Technical Implementation Guide","version":"1","release":"1"},"checks":[{"vulnId":"V-286580","ruleId":"SV-286580r1290903_rule","severity":"medium","ruleTitle":"The UAG must enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies.","description":"The UAG administrative interface provides two roles, a full administrative role, and a low-privilege administrator role that can perform a limited number of tasks such as read-only operations, system monitoring, downloading logs, and exporting configurations.\n\nCare must be taken to ensure only authorized users are provided access to the UAG administrative interface, and the list of low-privilege administrator accounts is periodically reviewed for accuracy.","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> Account Settings. \n\nClick the gear icon to edit.\n\nVerify the privileged accounts are configured and enabled based on organizational roles.\n\nIf the UAG contains any enabled privileged accounts and do not conform to organizational roles, this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> Account Settings. \n\nClick the gear icon to edit.\n\nEnable or disable each privileged account to conform to organizational roles.\n\nClick \"Save\" and \"Close\".","ccis":["CCI-000213"]},{"vulnId":"V-286581","ruleId":"SV-286581r1290906_rule","severity":"medium","ruleTitle":"The UAG administrative interface must display the Standard Mandatory DoW-approved Notice and Consent Banner before allowing access.","description":"Application servers are required to display the Standard Mandatory DoW Notice and Consent Banner before granting access to the system, providing privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance that states that:\n\n(i) users are accessing a U.S. government information system;\n(ii) system usage may be monitored, recorded, and subject to audit;\n(iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and\n(iv) the use of the system indicates consent to monitoring and recording.\n\nSystem use notification messages can be implemented in the form of warning banners displayed when individuals log on to the information system.\n\nSystem use notification is intended only for information system access including an interactive logon interface with a human user, and is not required when an interactive interface does not exist.\n\nUse this banner for desktops, laptops, and other devices accommodating banners of 1300 characters. The banner must be implemented as a click-through banner at logon (to the extent permitted by the operating system), meaning it prevents further activity on the information system unless and until the user executes a positive action to manifest agreement by clicking on a box indicating \"OK\".\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to edit.\n\nScroll down to the \"Admin Disclaimer Text\" field.\n\nIf the \"Admin Disclaimer Text\" field does not contain the Standard Mandatory DoW Notice and Consent Banner text, this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to edit.\n\nScroll down to the \"Admin Disclaimer Text\" field.\n\nIn the \"Admin Disclaimer Text\" field, supply the Standard Mandatory DoW Notice and Consent Banner text:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\nClick \"Save\".","ccis":["CCI-000048"]},{"vulnId":"V-286582","ruleId":"SV-286582r1294285_rule","severity":"medium","ruleTitle":"The UAG user interface must display the Standard Mandatory DoW-approved Notice and Consent Banner before allowing access.","description":"Application servers are required to display the Standard Mandatory DoW Notice and Consent Banner before granting access to the system, providing privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance that states that:\n\n(i) users are accessing a U.S. government information system;\n(ii) system usage may be monitored, recorded, and subject to audit;\n(iii) unauthorized use of the system is prohibited and subject to criminal and civil penalties; and\n(iv) the use of the system indicates consent to monitoring and recording.\n\nSystem use notification messages can be implemented in the form of warning banners displayed when individuals log on to the information system.\n\nSystem use notification is intended only for information system access including an interactive logon interface with a human user, and is not required when an interactive interface does not exist.\n\nUse this banner for desktops, laptops, and other devices accommodating banners of 1300 characters. The banner must be implemented as a click-through banner at logon (to the extent permitted by the operating system), meaning it prevents further activity on the information system unless and until the user executes a positive action to manifest agreement by clicking on a box indicating \"OK\".\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\nSatisfies: SRG-NET-000042-ALG-000023, SRG-NET-000043-ALG-000024","checkContent":"If the UAG Horizon Edge Settings are disabled, this control is not applicable.\n\nLog in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to General Settings >> Edge Service Settings. Toggle the slider to show the settings.\n\nClick the gear icon next to \"Horizon Settings\".\n\nIf necessary, toggle the slider next to \"Enable Horizon\" to show the settings. Click \"More\" to expand the settings.\n\nIf the \"Disclaimer Text\" field does not contain the Standard Mandatory DoW Notice and Consent Banner text, this is a finding.\n\nNote: The \"Disclaimer Text\" field will not show unless common access card (CAC) authorization is configured first in \"Auth Methods\".","fixText":"If the UAG Horizon Edge Settings are disabled, this control is not applicable.\n\nLog in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to General Settings >> Edge Service Settings. Toggle the slider to show the settings.\n\nClick the gear icon next to \"Horizon Settings\".\n\nIf necessary, toggle the slider next to \"Enable Horizon\" to show the settings. Click \"More\" to expand the settings.\n\nIn the \"Disclaimer Text\" field, supply the Standard Mandatory DoW Notice and Consent Banner text:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\nClick \"Save\".","ccis":["CCI-000050","CCI-001384","CCI-001385","CCI-001386","CCI-001387","CCI-001388"]},{"vulnId":"V-286583","ruleId":"SV-286583r1291665_rule","severity":"medium","ruleTitle":"The FIPS version of the UAG must be deployed to protect the confidentiality and integrity of remote access sessions.","description":"Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session.\n\nRemote access is access to DoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include broadband connections, wireless connections, and proxied remote encrypted traffic (e.g., TLS gateways, web content filters, and webmail proxies), for example.\n\nEncryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection, thereby providing a degree of confidentiality. The encryption strength of the mechanism is selected based on the security categorization of the information.\n\nSatisfies: SRG-NET-000062-ALG-000011, SRG-NET-000062-ALG-000092, SRG-NET-000063-ALG-000012, SRG-NET-000230-ALG-000113, SRG-NET-000234-ALG-000116, SRG-NET-000510-ALG-000025, SRG-NET-000510-ALG-000040, SRG-NET-000510-ALG-000111, SRG-NET-000570-ALG-000015, SRG-NET-000575-ALG-000020","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nAt the top of the page, the text reads \"Unified Access Gateway Appliance vXX.XX\". \n\nWhen the UAG is the version that uses FIPS 140-validated cryptographic modules, the line below will be \"(FIPS)\".\n\nIf the UAG appliance is not the version that uses FIPS 140-validated cryptographic modules, this is a finding.","fixText":"The UAG is distributed as two distinct .ova packages, the FIPS 140 version and the non-FIPS 140 version. \n\nThere is no way to enable FIPS on the non-FIPS version of the UAG. The fix for this finding is to redeploy the UAG using the FIPS .ova. This is beyond the scope of this STIG but is documented on https://docs.omnissa.com.","ccis":["CCI-000068","CCI-001453","CCI-001184","CCI-001188","CCI-002450"]},{"vulnId":"V-286584","ruleId":"SV-286584r1290915_rule","severity":"medium","ruleTitle":"The UAG must be configured to comply with the TLS versions required by NIST SP 800-52.","description":"Preventing the disclosure of transmitted information requires that the UAG take measures to employ strong cryptographic mechanisms to protect information during transmission. This is typically achieved through the use of Transport Layer Security (TLS).\n\nTLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems.\n\nAccording to NIST and as of publication, TLS 1.1 (and earlier) must not be used, while TLS 1.2 and TLS 1.3 must be enabled.\n\nNote: Mandating TLS 1.2 or TLS 1.3 may affect certain client types. Test and implement carefully.\n\nSatisfies: SRG-NET-000062-ALG-000150, SRG-NET-000147-ALG-000095, SRG-NET-000400-ALG-000097","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to edit.\n\nLocate the \"Enable TLS\" sliders. Validate the sliders as follows:\n\n\"Enable TLS 1.1\" : Disabled\n\"Enable TLS 1.2 and TLS 1.3\" : Enabled\n\nIf the supported TLS protocols are not configured as above, this is a finding.\n\nNote: When the FIPS UAG appliance is deployed, the \"Enable TLS 1.1 \" slider will be disabled and greyed out. The \"Enable TLS 1.2\" slider can enabled.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to edit.\n\nLocate the \"Enable TLS\" sliders. Position the sliders as follows:\n\n\"Enable TLS 1.1\" : Disabled\n\"Enable TLS 1.2 and TLS 1.3\" : Enabled\n\nClick \"Save\".","ccis":["CCI-000068","CCI-001941","CCI-000197"]},{"vulnId":"V-286585","ruleId":"SV-286585r1290918_rule","severity":"medium","ruleTitle":"The UAG must not have unnecessary services and functions enabled.","description":"The primary function of the UAG is to proxy connections to a Horizon Connection Server. There are multiple methods that clients can use to connect to a Horizon Connection Server, including PCoIP, Blast, HTML Access, and Secure Tunnels. Any of the methods that are not used in the environment must not be enabled to limit attack surface area.\n\nSatisfies: SRG-NET-000131-ALG-000085, SRG-NET-000131-ALG-000086, SRG-NET-000313-ALG-000010","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to General Settings >> Edge Service Settings. Toggle the slider to show the settings.\n\nClick the gear icon next to \"Horizon Settings\".\n\nIf necessary, toggle the slider next to \"Enable Horizon\" to show the settings.\n\nCheck the status of the following toggle items:\n\nEnable PCOIP\nEnable Blast\nEnable UDP Tunnel Server\nEnable Tunnel\nDisable Web Client\n\nIf any item is enabled but not in use in the environment, this is a finding.\n\nNavigate to General Settings >> Edge Service Settings. Toggle the slider to show the settings.\n\nClick the gear icon next to each of the following:\n\nReverse Proxy Settings (not supported in FIPS mode)\nTunnel Settings\nSecure Email Gateway Settings\nContent Gateway Settings (not supported in FIPS mode)\n\nIf any non-Horizon Edge Service is enabled, but not in use in the environment, this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to \"General Settings\" >> \"Edge Service Settings\" >> Toggle the slider to show the settings.\n\nClick the gear icon next to \"Horizon Settings\".\n\nIf necessary, toggle the slider next to \"Enable Horizon\" to show the settings.\n\nFor each item below, enable or disable the toggle based on desired environment settings:\n\nEnable PCOIP\nEnable Blast\nEnable Tunnel\nEnable UDP Tunnel Server\nDisable Web Client\n\nClick \"Save\".\n\nNavigate to General Settings >> Edge Service Settings. Toggle the slider to show the settings.\n\nClick the gear icon next to each of the following, then enable or disable the toggle based on desired environment settings:\n\nReverse Proxy Settings (not supported in FIPS mode)\nTunnel Settings\nSecure Email Gateway Settings\nContent Gateway Settings (not supported in FIPS mode)\n\nClick \"Save\".","ccis":["CCI-000381","CCI-002314"]},{"vulnId":"V-286586","ruleId":"SV-286586r1294287_rule","severity":"medium","ruleTitle":"The UAG must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.","description":"The use of unauthorized functions, ports, protocols, or services increases the attack surface of the UAG and may expose the system to exploitation. Restricting network-accessible services to only those required for mission operations reduces risk, supports least functionality principles, and helps ensure compliance with organizational PPSM requirements and vulnerability management processes.","checkContent":"Verify the UAG is configured to expose only those services, ports, and protocols authorized by the organization's PPSM registration and approved system baseline.\n\nLog in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to General Settings >> Edge Service Settings. Toggle the slider to show the settings.\n\nReview all enabled Edge services.\n\nReview the listener ports configured for each enabled service.\n\nReview the protocols enabled for client and administrative access.\n\nCompare the configured services, ports, and protocols against the organization's PPSM registration and approved architecture documentation.\n\nVerify the following:\n\n- Only required services are enabled.\n- Unused services are disabled.\n- Only approved ports are listening.\n- Only approved protocols are enabled.\n- Services identified as unnecessary or vulnerable by the organization have been disabled or otherwise mitigated.\n\nIf any unauthorized, unnecessary, or unapproved functions, ports, protocols, or services are enabled, this is a finding.","fixText":"Configure the UAG to permit only organization-authorized services, ports, and protocols.\n\nLog in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to General Settings >> Edge Service Settings. Toggle the slider to show the settings.\n\nDisable any Edge service that is not required for operational use.\n\nRemove or restrict any unauthorized listener ports.\n\nDisable any protocol that is not approved by the organization.\n\nUpdate the configuration to align with the approved PPSM registration and organization security policy.\n\nSave the configuration and restart affected services if required.","ccis":["CCI-000382"]},{"vulnId":"V-286587","ruleId":"SV-286587r1291669_rule","severity":"medium","ruleTitle":"The UAG must point to a specific Horizon server.","description":"A UAG must be paired with a specific Horizon server or a load balancer, depending on site specific architectures. This pairing is required for basic UAG to Horizon operation and ensures that authentication requests go to the proper servers.\n\nSatisfies: SRG-NET-000138-ALG-000089, SRG-NET-000364-ALG-000122","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to General Settings >> Edge Service Settings. Toggle the slider to show the settings.\n\nClick the gear icon next to \"Horizon Settings\".\n\nIf necessary, toggle the slider next to \"Enable Horizon\" to show the settings.\n\nIf the \"Connection Server URL\" is not configured with the correct Horizon Connection Server (or load balancer, depending on architecture) information, this is a finding.\n\nIf the UAG is not intended to provide Horizon services, but is used for other services in the environment, this control is not applicable.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to General Settings >> Edge Service Settings. Toggle the slider to show the settings.\n\nClick the gear icon next to \"Horizon Settings\".\n\nIf necessary, toggle the slider next to \"Enable Horizon\" to show the settings.\n\nEnsure the \"Connection Server URL\" is configured with the correct Horizon Connection Server (or load balancer, depending on architecture) information.\n\nClick \"Save\".","ccis":["CCI-000764","CCI-002403"]},{"vulnId":"V-286588","ruleId":"SV-286588r1294288_rule","severity":"medium","ruleTitle":"The UAG must perform initial validation of user Public Key Infrastructure (PKI) credentials.","description":"The UAG must be configured to perform initial validation of user common access card (CAC) certificates before passing authentication on to the Horizon server. The UAG does not perform authentication itself. This is done on the Horizon server, but it can ensure that the user certificate is trusted and allowed to attempt authentication.\n\nSatisfies: SRG-NET-000140-ALG-000094, SRG-NET-000339-ALG-000090","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to General Settings >> Edge Service Settings. Toggle the slider to show the settings.\n\nClick the gear icon next to \"X.509 Certificate\".\n\nIf the \"Enable X.509 Certificate\" is not toggled, this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to General Settings >> Authentication Settings. Toggle the slider to show the settings.\n\nClick the gear icon next to \"X.509 Certificate\".\n\nToggle the slider next to \"Enable X.509 Certificate\". \n\nClick \"Save\".","ccis":["CCI-000766","CCI-004046"]},{"vulnId":"V-286589","ruleId":"SV-286589r1291694_rule","severity":"medium","ruleTitle":"The UAG must be configured to determine certificate validity.","description":"A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate.\n\nCertification path validation includes checks such as certificate issuer trust, time validity, and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.\n\nThe UAG provides an \"Extended Server Certificate Validation\" option that will verify information including hostname match, verification status, and validity period.\n\nSatisfies: SRG-NET-000164-ALG-000100, SRG-NET-000345-ALG-000099","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to General Settings >> Authentication Settings. Toggle the slider to show the settings.\n\nClick the gear icon next to \"X.509 Certificate\".\n\nIf \"Enable Cert Revocation\" is not toggled on, this is a finding.\n\nVerify that at least one of the following options is enabled:\n\nOption 1: Either the \"Use CRL from Certificates\" checkbox is enabled or the \"CRL Location\" text box contains a valid value.\n\nOption 2: Verify the \"Enable OCSP Revocation\" checkbox is enabled, and either the \"Use OCSP URL from certificate\" checkbox is enabled or the \"OCSP URL\" text box contains a valid value.\n\nIf both options are enabled (CRL and OCSP), verify the \"Use CRL in case of OCSP Failure\" toggle is enabled.\n\nIf neither CRL nor OCSP certificate validation is enabled, this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to General Settings >> Authentication Settings. Toggle the slider to show the settings.\n\nClick the gear icon next to \"X.509 Certificate\".\n\nToggle the slider next to \"Enable Cert Revocation\", if necessary.\n\nEnsure that at least one of the following options is enabled:\n\nOption 1: Either the \"Use CRL from Certificates\" checkbox is enabled or the \"CRL Location\" text box contains a value.\n\nOption 2: Ensure the \"Enable OCSP Revocation\" checkbox is enabled, and either the \"Use OCSP URL from certificate\" checkbox is enabled or the \"OCSP URL\" text box contains a value.\n\nIf both options are enabled (CRL and OCSP), ensure the \"Use CRL in case of OCSP Failure\" toggle is enabled.\n\nClick \"Save\".","ccis":["CCI-000185","CCI-004068"]},{"vulnId":"V-286590","ruleId":"SV-286590r1290933_rule","severity":"medium","ruleTitle":"The UAG must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.","description":"A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate. \n\nThe UAG provides an \"Extended Server Certificate Validation\" option that will verify information including hostname match, verification status, and validity period.\n\nSatisfies: SRG-NET-000164-ALG-000100, SRG-NET-000750-ALG-000140","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to edit.\n\nScroll down to the \"Extended Server Certificate Validation\" field.\n\nIf the \"Extended Server Certificate Validation\" toggle is not enabled, this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to edit.\n\nScroll down to the \"Extended Server Certificate Validation\" field and enable the toggle.\n\nClick \"Save\".","ccis":["CCI-000185","CCI-004909"]},{"vulnId":"V-286591","ruleId":"SV-286591r1290936_rule","severity":"medium","ruleTitle":"The UAG must limit the length of time that a client session can stay connected.","description":"Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a user session. For this reason, the UAG must enforce an absolute limit on client connection times.\n\nNote: This value must be the same as the \"Forcibly disconnect users\" setting on the Horizon Connection Server(s).\n\nSatisfies: SRG-NET-000213-ALG-000107, SRG-NET-000337-ALG-000096","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to edit.\n\nScroll down to the \"Session Timeout\" field.\n\nIf the \"Session Timeout\" is not configured within the organization defined permitted time limit (default is 10 hours), this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to edit.\n\nScroll down to the \"Session Timeout\" field.\n\nSet the \"Session Timeout\" value within the organization defined permitted time limit.\n\nClick \"Save\".\n\nNote: The \"Session Timeout\" value on the UAG must be the same as the \"Forcibly disconnect users\" value on the Horizon Connection Server(s).","ccis":["CCI-001133","CCI-002038"]},{"vulnId":"V-286592","ruleId":"SV-286592r1291673_rule","severity":"medium","ruleTitle":"The UAG must off-load all audit records to a centralized log server.","description":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n\nOff-loading is a common process in information systems with limited audit storage capacity.\n\nSatisfies: SRG-NET-000334-ALG-000050, SRG-NET-000511-ALG-000051","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> Syslog Server Settings.\n\nClick the gear icon to edit.\n\nIf no valid syslog servers are configured, this is a finding.\n\nFor each syslog server present, click the associated gear icon and verify the following: \n\n1. Verify the \"Syslog Include System Messages\" toggle is enabled.\n\nIf the \"Syslog Include System Messages\" toggle is not enabled on each configured syslog server, this is a finding.\n\n2. Verify the \"Category\" drop-down menu is equal to \"All Events\".\n\nIf the \"Category\" is not set to \"All Events\" on each configured syslog server, this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> Syslog Server Settings. \n\nClick the gear icon to edit.\n\nAdd a new syslog server:\n\n- Click \"Add Syslog Entry\", select the desired protocol and fill in all required fields. Ensure that the \"Syslog Include System Messages\" toggle is enabled.\n\n- Set \"Category\" drop-down menu to \"All Events\".\n\n- Click \"Add\", then click \"Save\".\n\nEdit an existing syslog server:\n\n- For each syslog server present, click the associated gear icon and enable the \"Syslog Include System Messages\" toggle.\n\n- Set \"Category\" drop-down to \"All Events\".\n\n- Click \"OK\".","ccis":["CCI-001851"]},{"vulnId":"V-286593","ruleId":"SV-286593r1294290_rule","severity":"medium","ruleTitle":"The UAG must only allow Public Key Infrastructure (PKI) login via certificates issued by DoW certificate authorities.","description":"Non-DoW approved PKIs have not been evaluated to ensure that they have security controls and identity vetting procedures in place which are sufficient for DoW systems to rely on the identity asserted in the certificate. PKIs lacking sufficient security controls and identity vetting procedures risk being compromised and issuing certificates that enable adversaries to impersonate legitimate users.","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to General Settings >> Authentication Settings. Toggle the slider to show the settings.\n\nClick the gear icon next to \"X.509 Certificate\".\n\nNext to \"Root and Intermediate CA Certificates\", click \"View\".\n\nIf any certificates in the list are issued by a non-DoW authority, this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to General Settings >> Authentication Settings. Toggle the slider to show the settings.\n\nClick the gear icon next to \"X.509 Certificate\".\n\nNext to \"Root and Intermediate CA Certificates\", click \"View\".\n\nDelete any certificates issued by a non-DoW authority.\n\nClick \"Save\".","ccis":["CCI-002470"]},{"vulnId":"V-286594","ruleId":"SV-286594r1290945_rule","severity":"medium","ruleTitle":"The UAG must have a clock skew tolerance of less than five minutes.","description":"The UAG supports Security Assertion Markup Language (SAML) authentication, which relies on the validation of time-based conditions contained within SAML assertions. These conditions include fields such as \"NotBefore\" and \"NotOnOrAfter\", which define the period during which an assertion is considered valid.\n\nTo account for minor differences between the system clocks of the Identity Provider (IdP) and the UAG, the appliance provides a configurable \"Clock Skew Tolerance\" setting. This value specifies the maximum allowable time difference, in seconds, that will be accepted during SAML assertion validation.\n\nIf the Clock Skew Tolerance value is configured excessively high, expired or not-yet-valid assertions may be accepted beyond the intended validity period, increasing the window of opportunity for replay attacks or unauthorized use of authentication assertions. Limiting the Clock Skew Tolerance to no more than 300 seconds (five minutes) ensures sufficient tolerance for normal clock synchronization variances while minimizing the risk of accepting stale or premature SAML assertions.\n\nFailure to properly configure this setting may weaken the effectiveness of SAML assertion validation and increase the risk of unauthorized access to system resources.","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to verify the settings.\n\nIf the \"Clock Skew Tolerance\" value is greater than \"300\" (five minutes), this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to verify the settings.\n\nEnsure the \"Clock Skew Tolerance\" value is \"300\" (five minutes).\n\nClick \"Save\".","ccis":["CCI-000366"]},{"vulnId":"V-286595","ruleId":"SV-286595r1291695_rule","severity":"medium","ruleTitle":"The UAG must disable host time synchronization and use authoritative Network Time Protocol (NTP) time sources.","description":"Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events.\n\nSynchronization of system clocks is needed to correctly correlate the timing of events that occur across multiple systems. To meet this requirement, the organization must define authoritative time sources and configure each UAG system to use the authoritative time sources.\n\nThe UAG provides an option to synchronize the time with the ESXi host, only if running on a VMware ESXi host. This option must be disabled, and NTP time servers configured, to ensure all components (servers, hosts, network devices, etc.) are using the same NTP time sources.","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to verify the settings.\n\nIf the \"Time Sync With Host\" toggle is enabled, this is a finding.\n\nIf the \"NTP Servers\" does not contain a list of valid authoritative NTP time sources, this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to verify the settings.\n\nEnsure the \"Time Sync With Host\" toggle is disabled.\n\nEnsure the \"NTP Servers\" section contains a list of valid authoritative NTP time sources.\n\nClick \"Save\".","ccis":["CCI-000366"]},{"vulnId":"V-286596","ruleId":"SV-286596r1290951_rule","severity":"medium","ruleTitle":"The UAG local administrator account must be configured with a password maximum lifetime of 60 days or less.","description":"If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the passwords and related accounts could be compromised. One method of minimizing this risk is to force users to use complex passwords and periodically change them.","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to verify the settings.\n\nIf the \"Password Age\" is set to \"0\" or is set to a value greater than \"60\", this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to verify the settings.\n\nEnsure the \"Password Age\" is set to \"60\".\n\nClick \"Save\".","ccis":["CCI-000366"]},{"vulnId":"V-286597","ruleId":"SV-286597r1290954_rule","severity":"medium","ruleTitle":"The UAG local monitoring accounts must be configured with a password maximum lifetime of 90 days or less.","description":"If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the passwords and related accounts could be compromised. One method of minimizing this risk is to force users to use complex passwords and periodically change them.","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to verify the settings.\n\nIf the \"Monitoring User Password Age\" is set to \"0\" or a value greater than \"90\", this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to verify the settings.\n\nEnsure the \"Monitoring User Password Age\" is set to \"90\".\n\nClick \"Save\".","ccis":["CCI-000366"]},{"vulnId":"V-286598","ruleId":"SV-286598r1290957_rule","severity":"medium","ruleTitle":"The UAG must configure SNMP properly.","description":"SNMPv3 supports commercial-grade security, including authentication, authorization, access control, and privacy. Previous versions of the protocol contain well-known security weaknesses that can be easily exploited. As such, SNMPv1 and SNMPv2 receivers must be disabled.\n\nIf SNMP is not being used, it must remain disabled. If SNMP is enabled but not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack.","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration. \n\nClick the gear icon.\n\nIf the \"Enable SNMP\" toggle is set to \"On\", and the \"SNMP Version\" dropdown is set to \"SNMPv1+SNMPv2c\", this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to \"Advanced Settings\" >> \"System Configuration\". \n\nClick the gear icon.\n\nEither set the \"Enable SNMP\" toggle to \"Off\", or set it to \"On\", and ensure the \"SNMP Version\" is set to \"SNMPv3\", then fill in all required fields.\n\nClick \"Save\".","ccis":["CCI-000366"]},{"vulnId":"V-286599","ruleId":"SV-286599r1290960_rule","severity":"medium","ruleTitle":"The UAG must only generate messages that provide information necessary for corrective actions without revealing sensitive or potentially harmful information in error logs and administrative messages.","description":"Any application providing too much information in error logs and in Administrative messages to the screen risks compromising the data and security of the application and system. The structure and content of error messages must be carefully considered by the organization and development team. The application server must not log sensitive information such as passwords, private keys, or other sensitive data. This requirement pertains to logs that are generated by the application server and application server processes, not the applications that may reside on the application server. Those errors are out of the scope of these requirements.","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Support Settings >> Log Level Settings.\n\nClick the gear icon to edit.\n\nIf the log level settings does not contain an entry for \"All - INFO\", this is a finding.\n\nNote: \"DEBUG\" and \"TRACE\" log levels must be applied only during troubleshooting as these levels can reduce performance and increase the verbose log messages. After troubleshooting using the DEBUG or TRACE log levels, the log level must be reset to INFO or the component or subcomponent must be removed from the log settings.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Support Settings >> Log Level Settings.\n\nClick the gear icon to edit.\n\nRemove any unnecessary log components.\n\nRemove any components with a \"DEBUG\" or \"TRACE\" level, unless actively troubleshooting an issue.\n\nEnsure, at a minimum, that an entry for \"All - INFO\" is added.","ccis":["CCI-000366"]},{"vulnId":"V-286600","ruleId":"SV-286600r1294292_rule","severity":"medium","ruleTitle":"The UAG must be configured with a DoW-issued TLS certificate.","description":"Machines on a DoW network must only accept Public Key Infrastructure (PKI) certificates obtained from a DoW-approved internal or external certificate authority (CA). If the CA used for verifying the certificate is not DoW-approved, trust of the CA will not be established.\n\nThe UAG supports the replacement of the default, self-signed certificate with one issued by a DoW CA.","checkContent":"Navigate to the UAG login page (user and/or admin page, depending on environment setup).\n\nIn the browser's URL address bar, find the certificate settings validating the site is secure and select to \"View Certificate\" (each browser is different).\n\nIn the \"Certificate\" dialog box, click the \"Details\" tab, then the \"Issuer\" field.\n\nValidate the issuer is on the DoW-approved issuer list.\n\nIf the UAG does not use certificates that have been issued by a DoW-approved Certificate Authority (CA), this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> TLS Server Certificate Settings.\n\nSelect the certificate type and network interfaces to apply the certificate to, then upload valid DoW-issued certificate files into the required fields.\n\nClick \"Save\".\n\nNote: If configuring UAG Commercial Solutions for Classified (CSfC) Compliant mode, ensure the certificates are issued with SHA-384 or greater signature.","ccis":["CCI-000366"]},{"vulnId":"V-286601","ruleId":"SV-286601r1294295_rule","severity":"medium","ruleTitle":"The UAG must configure the Response Security Headers.","description":"Clickjacking, also known as a \"UI redress\" attack, is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top level page. Thus, the attacker is \"hijacking\" clicks meant for the original page and routing them to another page, most likely owned by another application, domain, or both.\n\nUsing a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they are typing in the password to their email or bank account but are instead typing into an invisible frame controlled by the attacker.","checkContent":"If the UAG Horizon Edge Settings are disabled, this control is not applicable.\n\nLog in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to \"General Settings\" and set the \"Edge Service Settings\" toggle to \"SHOW\".\n\nClick the gear icon to view the Horizon Settings.\n\nClick \"More\" at the bottom of the dialog.\n\nIf the \"Response Security Headers\" do not contain all the following entries, this is a finding.\n\n1. \"X-Frame-Options\" with a value of \"SAMEORIGIN\".\n\n2. \"Strict-Transport-Security\" (The default UAG Strict-Transport-Security value is \"max-age=63072000; includeSubdomains; preload\").\n\n3. \"X-Content-Type-Options\" with a value of \"nosniff\".","fixText":"If the UAG Horizon Edge Settings are disabled, this control is not applicable.\n\nLog in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to \"General Settings\" and set the \"Edge Service Settings\" toggle to \"SHOW\".\n\nClick the gear icon to view the Horizon Settings.\n\nClick \"More\" at the bottom of the dialog.\n\nAdd or edit \"Response Security Headers\" to contain all the following entries:\n\n1. \"X-Frame-Options\" entry and ensure it has a value of \"SAMEORIGIN\".\n\n2. \"Strict-Transport-Security\" entry and ensure it has a value of \"max-age=63072000; includeSubdomains; preload\".\n\n3. \"X-Content-Type-Options\" entry and ensure it has a value of \"nosniff\".\n\nClick \"Save\".","ccis":["CCI-000366"]},{"vulnId":"V-286602","ruleId":"SV-286602r1290969_rule","severity":"medium","ruleTitle":"The UAG must not provide environment information to third parties.","description":"Providing technical details about environmental infrastructure to third parties could unknowingly expose sensitive information to bad actors if intercepted.","checkContent":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to verify the settings.\n\nIf the \"Join CEIP\" toggle is enabled, this is a finding.","fixText":"Log in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to verify the settings.\n\nEnsure the \"Join CEIP\" toggle is disabled.\n\nClick \"Save\".","ccis":["CCI-000366"]},{"vulnId":"V-286603","ruleId":"SV-286603r1294298_rule","severity":"medium","ruleTitle":"The UAG must use cryptographic algorithms approved by the National Security Agency (NSA) to protect Network Security Services (NSS) when transporting classified traffic across an unclassified network.","description":"Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data.\n\nNIST cryptographic algorithms are approved by NSA to protect NSS. Based on an analysis of the impact of quantum computing, cryptographic algorithms specified by CNSSP-15 and approved for use in products in the Commercial Solutions for Classified (CSfC) program have been changed to more stringent protocols and configured with increased bit sizes and other secure characteristics to protect against quantum computing threats. The Commercial National Security Algorithm Suite (CNSA Suite) replaces Suite B.\n\nThis requirement also applies to Zero Trust initiatives.\n\nSatisfies: SRG-NET-000352-ALG-000110, SRG-NET-000565-ALG-000010","checkContent":"If the UAG is not used to remotely access a classified network from an unclassified network, this requirement is not applicable.\n\nLog in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to edit.\n\n1. Verify \"TLS Server Cipher Suites\" is set to: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\n\n2. Verify \"TLS Client Cipher Suites\" is set to:\nTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384\n\n3. Verify \"SSL Provider\" is set to \"JDK\".\n\n4. Verify \"TLS Named Groups\" is set to:\nsecp256r1,secp384r1,secp521r1,ffdhe2048,ffdhe3072,ffdhe4096,ffdhe6144,ffdhe8192\n\n5. Verify \"TLS Signature Schemes\" is set to \"rsa_pkcs1_sha384\".\n\n6. Verify the \"Extended Server Certificate Validation\" toggle is enabled.\n\n7. Verify the minimum \"SHA Hash Size\" is set to \"SHA-384\".\n\nIf any of the above are not properly configured, this is a finding.","fixText":"If the UAG is not used to remotely access a classified network from an unclassified network, this requirement is not applicable.\n\nLog in to the UAG administrative interface as an administrator.\n\nSelect \"Configure Manually\".\n\nNavigate to Advanced Settings >> System Configuration.\n\nClick the gear icon to edit.\n\n1. Set \"TLS Server Cipher Suites\" to: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\n\n2. Set \"TLS Client Cipher Suites\" to:\nTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384\n\n3. Set \"SSL Provider\" to \"JDK\".\n\n4. Set \"TLS Named Groups\" to:\nsecp256r1,secp384r1,secp521r1,ffdhe2048,ffdhe3072,ffdhe4096,ffdhe6144,ffdhe8192\n\n5. Set \"TLS Signature Schemes\" to \"rsa_pkcs1_sha384\".\n\n6. Enable the \"Extended Server Certificate Validation\" toggle.\n\n7. Set Minimum \"SHA Hash Size\" is set to \"SHA-384\".\n\nNote: If configuring UAG CSfC Compliant mode, ensure the certificates are issued with SHA-384 or greater signature.\n\nClick \"Save\".\n\nNote: Fully operating in CSfC mode may require reconfiguration of SAML providers and syslog. Consult Omnissa documentation for full details.","ccis":["CCI-002450"]}]}