SC-08 Transmission Confidentiality and Integrity
All changes in this version
Title
Transmission Confidentiality and Integrity
Control
Protect the [Selection (one or more): confidentiality; integrity] of transmitted information.
Discussion
Protecting the confidentiality and integrity of transmitted information applies to internal and external networks as well as any system components that can transmit information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of information can be accomplished by physical or logical means. Physical protection can be achieved by using protected distribution systems. A protected distribution system is a wireline or fiber-optics telecommunications system that includes terminals and adequate electromagnetic, acoustical, electrical, and physical controls to permit its use for the unencrypted transmission of classified information. Logical protection can be achieved by employing encryption techniques.
Organizations that rely on commercial providers who offer transmission services as commodity services rather than as fully dedicated services may find it difficult to obtain the necessary assurances regarding the implementation of needed controls for transmission confidentiality and integrity. In such situations, organizations determine what types of confidentiality or integrity services are available in standard, commercial telecommunications service packages. If it is not feasible to obtain the necessary controls and assurances of control effectiveness through appropriate contracting vehicles, organizations can implement appropriate compensating controls.
Parameters
sc-08_odp: [confidentiality; integrity]
Related controls
ac-17, ac-18, au-10, ia-3, ia-8, ia-9, ma-4, pe-4, sa-4, sa-8, sc-16, sc-20, sc-23, sc-28, sc-7
Assessment objective
SC-08 the [Selection (one or more): confidentiality; integrity] of transmitted information is/are protected.
STIG rules that implement this control 50
Apple macOS 15 (Sequoia) V1R8
- APPL-15-002062 CAT I The macOS system must disable Bluetooth when no approved device is connected.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-002062 CAT I The macOS system must disable Bluetooth when no approved device is connected.
Application Security and Development V6R5
- APSC-DV-002440 CAT I The application must protect the confidentiality and integrity of transmitted information.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-255010 CAT I Ubuntu 22.04 LTS must have SSH installed.
- UBTU-22-255015 CAT I Ubuntu 22.04 LTS must use SSH to protect the confidentiality and integrity of transmitted information.
- UBTU-22-291015 CAT II Ubuntu 22.04 LTS must disable all wireless network adapters.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100800 CAT I Ubuntu 24.04 LTS must have SSH installed.
- UBTU-24-100810 CAT I Ubuntu 24.04 LTS must use SSH to protect the confidentiality and integrity of transmitted information.
- UBTU-24-600230 CAT II Ubuntu 24.04 LTS must disable all wireless network adapters.
Microsoft Windows 11 V2R11
- WN11-CC-000055 CAT II Simultaneous connections to the internet or a Windows domain must be limited.
- WN11-SO-000035 CAT II Outgoing secure channel traffic must be encrypted or signed.
- WN11-SO-000040 CAT II Outgoing secure channel traffic must be encrypted.
- WN11-SO-000045 CAT II Outgoing secure channel traffic must be signed.
- WN11-SO-000060 CAT II The system must be configured to require a strong session key.
- WN11-SO-000100 CAT II The Windows SMB client must be configured to always perform SMB packet signing.
- WN11-SO-000120 CAT II The Windows SMB server must be configured to always perform SMB packet signing.
Microsoft Windows Server 2022 V2R11
- WN22-DC-000320 CAT II Windows Server 2022 domain controllers must require LDAP access signing.
- WN22-SO-000060 CAT II Windows Server 2022 setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.
- WN22-SO-000070 CAT II Windows Server 2022 setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to Enabled.
- WN22-SO-000080 CAT II Windows Server 2022 setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.
- WN22-SO-000110 CAT II Windows Server 2022 must be configured to require a strong session key.
- WN22-SO-000160 CAT II Windows Server 2022 setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.
- WN22-SO-000170 CAT II Windows Server 2022 setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.
- WN22-SO-000190 CAT II Windows Server 2022 setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.
- WN22-SO-000200 CAT II Windows Server 2022 setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.
Microsoft Windows Server 2025 V1R4
- WN25-DC-000320 CAT II Windows Server 2025 domain controllers must require LDAP access signing.
- WN25-SH-000010 CAT II Windows Server 2025 networked systems must have and implement OpenSSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
- WN25-SH-000050 CAT II Windows Server 2025 OpenSSH must force a frequent session key renegotiation for SSH connections to the server.
- WN25-SO-000060 CAT II The Windows Server 2025 setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.
- WN25-SO-000070 CAT II Windows Server 2025 setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to Enabled.
- WN25-SO-000080 CAT II The Windows Server 2025 setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.
- WN25-SO-000110 CAT II Windows Server 2025 must be configured to require a strong session key.
- WN25-SO-000160 CAT II The Windows Server 2025 setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.
- WN25-SO-000170 CAT II The Windows Server 2025 setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.
- WN25-SO-000190 CAT II The Windows Server 2025 setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.
- WN25-SO-000200 CAT II The Windows Server 2025 setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-000500 CAT I RHEL 10 must enable FIPS mode.
- RHEL-10-200720 CAT II RHEL 10 must have a Secure Shell (SSH) server installed for all networked systems.
- RHEL-10-200721 CAT II RHEL 10 must, for all networked systems, have and implement Secure Shell (SSH) to protect the confidentiality and integrity of transmitted and received information.
- RHEL-10-300030 CAT I RHEL 10 must be configured so that Secure Shell (SSH) clients use only DoW-approved encryption ciphers employing FIPS 140-3-validated cryptographic hash algorithms to protect the confidentiality of SSH client connections.
- RHEL-10-300080 CAT I RHEL 10 must implement DoW-approved encryption in the bind package.
- RHEL-10-700650 CAT I RHEL 10 must force a frequent session key renegotiation for Secure Shell (SSH) connections to the server.
- RHEL-10-700870 CAT II RHEL 10 must disable wireless network adapters.
- RHEL-10-800020 CAT II RHEL 10 must enforce that network interfaces not be in promiscuous mode.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-255010 CAT II All RHEL 9 networked systems must have SSH installed.
- RHEL-09-255015 CAT II All RHEL 9 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
- RHEL-09-255090 CAT II RHEL 9 must force a frequent session key renegotiation for SSH connections to the server.
- RHEL-09-291040 CAT II RHEL 9 wireless network adapters must be disabled.
- RHEL-09-671010 CAT I RHEL 9 must enable FIPS mode.
- RHEL-09-672050 CAT I RHEL 9 must implement DoW-approved encryption in the bind package.