IBM Aspera Platform 4.2 Security Technical Implementation Guide

The IBM Aspera Platform 4.2 Security Technical Implementation Guide (V1 R3) has 95 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

95STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R3

CurrentPublished Thu Jan 30 2025 What changed in V1R3

The IBM Aspera Faspex private/secret cryptographic keys file must be group-owned by faspex to prevent unauthorized read access.

IBM Aspera Platform 4.2 Security Technical Implementation Guide

Assessment Title

Rule Text

The IBM Aspera Faspex private/secret cryptographic keys file must be group-owned by faspex to prevent unauthorized read access.

Description

Discussion Text

Private key data is used to prove that the entity presenting a public key certificate is the certificate's rightful owner. Compromise of private key data allows an adversary to impersonate the key holder.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-252593

Rule

SV-252593r831507_rule

Severity

medium

Rule Version

ASP4-FA-050290

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

If the IBM Aspera Faspex feature of the Aspera Platform is not installed, this is Not Applicable.

Verify the /opt/aspera/faspex/config/secret.yml file is group-owned by faspex with the following command:

$ sudo stat -c "%G" /opt/aspera/faspex/config/secret.yml

faspex

If "faspex" is not returned as a result, this is a finding.

Implementation Procedure

Fix Text

Configure the /opt/aspera/faspex/config/secret.yml file to be group-owned by faspex with the following command:

$ sudo chgrp faspex /opt/aspera/faspex/config/secret.yml

STIG check 38 of 95 in the IBM Aspera Platform 4.2 STIG checklist

← Previous · V-252592IBM Aspera Faspex must protect audit information from unauthorized modification.Next · V-252594 →The IBM Aspera Faspex private/secret cryptographic keys file must be owned by faspex to prevent unauthorized read access.