← Back to General Application (GAPP) Security Requirements Guide

V-288291

CAT II (Medium)

The application must implement cryptographic mechanisms to authenticate organization-defined software or firmware components prior to installation.

Rule ID

SV-288291r1252458_rule

STIG

General Application (GAPP) Security Requirements Guide

Version

V1R0.1

CCIs

CCI-002740

Discussion

Unauthorized modifications to software or firmware may be indicative of a sophisticated, targeted cyberattack. Cryptographic authentication includes, for example, verifying that software or firmware components have been digitally signed using certificates recognized and approved by organizations. Code signing is an effective method to protect against malicious code.

Check Content

Review the application documentation and deployed configuration to determine whether the application implements cryptographic mechanisms to authenticate organization-defined software or firmware components prior to installation.

If the application does not implement cryptographic mechanisms to authenticate organization-defined software or firmware components prior to installation, this is a finding.

Fix Text

Configure the application to install security-relevant software updates within 30 days unless the time period is directed by an authoritative source (e.g., IAVM, CTOs, DTMs, STIGs).