V2R2 changes
Cisco ASA VPN STIG V2R2 (2024-10-24) replaced V2R1 (2024-07-24): 1 check added, 1 removed, 3 updated. It has 41 checks, against 41 in V2R1.
V2R2 checklistV2R1 checklist Compare V2R1 and V2R2 in STIG Compare
- 1 added
- 1 removed
- 3 updated
Updated fields: CCIs 2Discussion 1
Added in V2R2 (1)
- V-268314CAT IThe Cisco ASA must be configured to not accept certificates that have been revoked when using PKI for authentication.
Removed since V2R1 (1)
- V-239950CAT IThe Cisco ASA must be configured to not accept certificates that have been revoked when using PKI for authentication.
Updated in V2R2 (3)
V-239959CAT IThe Cisco ASA must be configured to use FIPS-validated SHA-2 or higher for Internet Key Exchange (IKE) Phase 2.Discussion
Discussion
Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions.
Although allowed by SP800-131Ar2 for some applications, SHA-1 is considered a compromised hashing standard and is being phased out of use by industry and Governmentgovernment standards. Unless required for legacy use, DoDDOD systems should not be configured to use SHA-21 for integrity of remote access sessions.
This requirement focuses on communications protection for the application session rather than for the network packet and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services/SOA will require the use of mutual authentication (two-way/bidirectional).
An IPsec Security Association (SA) is established using either IKE or manual configuration.
V-239963CAT IIThe Cisco ASA VPN gateway must be configured to renegotiate the IPsec Security Association after eight hours or less.CCIs
V-239964CAT IIThe Cisco ASA VPN gateway must be configured to renegotiate the IKE security association after 24 hours or less.CCIs
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R2 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.