Rule ID
SV-286584r1290915_rule
Version
V1R1
Preventing the disclosure of transmitted information requires that the UAG take measures to employ strong cryptographic mechanisms to protect information during transmission. This is typically achieved through the use of Transport Layer Security (TLS). TLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems. According to NIST and as of publication, TLS 1.1 (and earlier) must not be used, while TLS 1.2 and TLS 1.3 must be enabled. Note: Mandating TLS 1.2 or TLS 1.3 may affect certain client types. Test and implement carefully. Satisfies: SRG-NET-000062-ALG-000150, SRG-NET-000147-ALG-000095, SRG-NET-000400-ALG-000097
Log in to the UAG administrative interface as an administrator. Select "Configure Manually". Navigate to Advanced Settings >> System Configuration. Click the gear icon to edit. Locate the "Enable TLS" sliders. Validate the sliders as follows: "Enable TLS 1.1" : Disabled "Enable TLS 1.2 and TLS 1.3" : Enabled If the supported TLS protocols are not configured as above, this is a finding. Note: When the FIPS UAG appliance is deployed, the "Enable TLS 1.1 " slider will be disabled and greyed out. The "Enable TLS 1.2" slider can enabled.
Log in to the UAG administrative interface as an administrator. Select "Configure Manually". Navigate to Advanced Settings >> System Configuration. Click the gear icon to edit. Locate the "Enable TLS" sliders. Position the sliders as follows: "Enable TLS 1.1" : Disabled "Enable TLS 1.2 and TLS 1.3" : Enabled Click "Save".