Rule ID
SV-286583r1291665_rule
Version
V1R1
Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access is access to DoW nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include broadband connections, wireless connections, and proxied remote encrypted traffic (e.g., TLS gateways, web content filters, and webmail proxies), for example. Encryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection, thereby providing a degree of confidentiality. The encryption strength of the mechanism is selected based on the security categorization of the information. Satisfies: SRG-NET-000062-ALG-000011, SRG-NET-000062-ALG-000092, SRG-NET-000063-ALG-000012, SRG-NET-000230-ALG-000113, SRG-NET-000234-ALG-000116, SRG-NET-000510-ALG-000025, SRG-NET-000510-ALG-000040, SRG-NET-000510-ALG-000111, SRG-NET-000570-ALG-000015, SRG-NET-000575-ALG-000020
Log in to the UAG administrative interface as an administrator. At the top of the page, the text reads "Unified Access Gateway Appliance vXX.XX". When the UAG is the version that uses FIPS 140-validated cryptographic modules, the line below will be "(FIPS)". If the UAG appliance is not the version that uses FIPS 140-validated cryptographic modules, this is a finding.
The UAG is distributed as two distinct .ova packages, the FIPS 140 version and the non-FIPS 140 version. There is no way to enable FIPS on the non-FIPS version of the UAG. The fix for this finding is to redeploy the UAG using the FIPS .ova. This is beyond the scope of this STIG but is documented on https://docs.omnissa.com.