SC-08(01) Cryptographic Protection
NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
All changes in this version
Title
Cryptographic Protection
Control
Implement cryptographic mechanisms to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.
Discussion
Encryption protects information from unauthorized disclosure and modification during transmission. Cryptographic mechanisms that protect the confidentiality and integrity of information during transmission include TLS and IPSec. Cryptographic mechanisms used to protect information integrity include cryptographic hash functions that have applications in digital signatures, checksums, and message authentication codes.
Parameters
sc-08.01_odp: [prevent unauthorized disclosure of information; detect changes to information]
Related controls
sc-12, sc-13
Assessment objective
SC-08(01) cryptographic mechanisms are implemented to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.
STIG rules that implement this control 43
Apple macOS 15 (Sequoia) V1R8
- APPL-15-000054 CAT I The macOS system must limit SSHD to FIPS-compliant connections.
- APPL-15-000057 CAT I The macOS system must limit SSH to FIPS-compliant connections.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-000054 CAT I The macOS system must limit SSHD to FIPS-compliant connections.
- APPL-26-000057 CAT I The macOS system must limit SSH to FIPS-compliant connections.
Application Security and Development V6R5
- APSC-DV-002450 CAT II The application must implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS).
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-255050 CAT II Ubuntu 22.04 LTS must configure the SSH daemon to use FIPS 140-3-approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
- UBTU-22-255055 CAT II Ubuntu 22.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3-approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100820 CAT II Ubuntu 24.04 LTS must configure the SSH daemon to use FIPS 140-3 approved ciphers to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
- UBTU-24-100830 CAT II Ubuntu 24.04 LTS must configure the SSH daemon to use Message Authentication Codes (MACs) employing FIPS 140-3 approved cryptographic hashes to prevent the unauthorized disclosure of information and/or detect changes to information during transmission.
Microsoft Windows 11 V2R11
- WN11-00-000010 CAT II Windows 11 systems must have a Trusted Platform Module (TPM) enabled.
- WN11-00-000015 CAT II Windows 11 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.
- WN11-00-000020 CAT II Secure Boot must be enabled on Windows 11 systems.
- WN11-SO-000035 CAT II Outgoing secure channel traffic must be encrypted or signed.
- WN11-SO-000040 CAT II Outgoing secure channel traffic must be encrypted.
- WN11-SO-000045 CAT II Outgoing secure channel traffic must be signed.
Microsoft Windows Server 2022 V2R11
- WN22-DC-000320 CAT II Windows Server 2022 domain controllers must require LDAP access signing.
- WN22-SO-000060 CAT II Windows Server 2022 setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.
- WN22-SO-000070 CAT II Windows Server 2022 setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to Enabled.
- WN22-SO-000080 CAT II Windows Server 2022 setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.
- WN22-SO-000110 CAT II Windows Server 2022 must be configured to require a strong session key.
- WN22-SO-000160 CAT II Windows Server 2022 setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.
- WN22-SO-000170 CAT II Windows Server 2022 setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.
- WN22-SO-000190 CAT II Windows Server 2022 setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.
- WN22-SO-000200 CAT II Windows Server 2022 setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.
Microsoft Windows Server 2025 V1R4
- WN25-DC-000320 CAT II Windows Server 2025 domain controllers must require LDAP access signing.
- WN25-SH-000010 CAT II Windows Server 2025 networked systems must have and implement OpenSSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
- WN25-SH-000050 CAT II Windows Server 2025 OpenSSH must force a frequent session key renegotiation for SSH connections to the server.
- WN25-SO-000060 CAT II The Windows Server 2025 setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.
- WN25-SO-000070 CAT II Windows Server 2025 setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to Enabled.
- WN25-SO-000080 CAT II The Windows Server 2025 setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.
- WN25-SO-000110 CAT II Windows Server 2025 must be configured to require a strong session key.
- WN25-SO-000160 CAT II The Windows Server 2025 setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.
- WN25-SO-000170 CAT II The Windows Server 2025 setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.
- WN25-SO-000190 CAT II The Windows Server 2025 setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.
- WN25-SO-000200 CAT II The Windows Server 2025 setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200720 CAT II RHEL 10 must have a Secure Shell (SSH) server installed for all networked systems.
- RHEL-10-200721 CAT II RHEL 10 must, for all networked systems, have and implement Secure Shell (SSH) to protect the confidentiality and integrity of transmitted and received information.
- RHEL-10-700650 CAT I RHEL 10 must force a frequent session key renegotiation for Secure Shell (SSH) connections to the server.
- RHEL-10-700870 CAT II RHEL 10 must disable wireless network adapters.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-255010 CAT II All RHEL 9 networked systems must have SSH installed.
- RHEL-09-255015 CAT II All RHEL 9 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission.
- RHEL-09-255090 CAT II RHEL 9 must force a frequent session key renegotiation for SSH connections to the server.
- RHEL-09-291040 CAT II RHEL 9 wireless network adapters must be disabled.