What changed in IBM MQ Appliance V9.0 AS STIG V1R2V1R2 changes

IBM MQ Appliance V9.0 AS STIG V1R2 (2024-07-24) replaced V1R1 (2017-06-05): 43 checks added, 43 removed. It has 43 checks, against 43 in V1R1.

V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare

  • 43 added
  • 43 removed
  • 0 updated

Added in V1R2 (43)

  • V-255775CAT IIThe MQ Appliance messaging server must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
  • V-255776CAT IIThe MQ Appliance messaging server must implement cryptography mechanisms to protect the integrity of the remote access session.
  • V-255777CAT IIThe MQ Appliance messaging server must off-load log records onto a different system or media from the system being logged.
  • V-255778CAT IIIThe MQ Appliance messaging server must synchronize internal MQ Appliance messaging server clocks to an authoritative time source when the time difference is greater than the organization-defined time period.
  • V-255779CAT IIIThe MQ Appliance messaging server must compare internal MQ Appliance messaging server clocks at least every 24 hours with an authoritative time source.
  • V-255780CAT IIThe MQ Appliance messaging server must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
  • V-255781CAT IIThe MQ Appliance WebGUI interface to the messaging server must prohibit the use of cached authenticators after one hour.
  • V-255782CAT IIThe MQ Appliance messaging server must produce log records containing information to establish what type of events occurred.
  • V-255783CAT IIThe MQ Appliance messaging server must identify potentially security-relevant error conditions.
  • V-255784CAT IIThe MQ Appliance messaging server must provide access logging that ensures users who are granted a privileged role (or roles) have their privileged activity logged.
  • V-255785CAT IIThe MQ Appliance messaging server must alert the SA and ISSO, at a minimum, in the event of a log processing failure.
  • V-255786CAT IIThe MQ Appliance messaging server must provide an immediate warning to the SA and ISSO, at a minimum, when allocated log record storage volume reaches 75% of maximum log record storage capacity.
  • V-255787CAT IIThe MQ Appliance messaging server must protect against or limit the effects of all types of Denial of Service (DoS) attacks by employing operationally-defined security safeguards.
  • V-255788CAT IIThe MQ Appliance messaging server must automatically terminate a SSH user session after organization-defined conditions or trigger events requiring a session disconnect.
  • V-255789CAT IIThe MQ Appliance must automatically terminate a WebGUI user session after 600 seconds of idle time.
  • V-255790CAT IIThe MQ Appliance SSH interface to the messaging server must prohibit the use of cached authenticators after 600 seconds.
  • V-255791CAT IIThe MQ Appliance messaging server must only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected (messaging) sessions.
  • V-255792CAT IIThe version of MQ Appliance messaging server running on the system must be a supported version.
  • V-255793CAT IIThe MQ Appliance messaging server must use DoD- or CNSS-approved PKI Class 3 or Class 4 certificates.
  • V-255794CAT IIIThe MQ Appliance messaging server must accept FICAM-approved third-party credentials.
  • V-255795CAT IIThe MQ Appliance messaging server must provide a log reduction capability that supports on-demand reporting requirements.
  • V-255796CAT IIThe MQ Appliance messaging server must be configured to fail over to another system in the event of log subsystem failure.
  • V-255797CAT IIThe MQ Appliance messaging server must uniquely identify all network-connected endpoint devices before establishing any connection.
  • V-255798CAT IIAccess to the MQ Appliance messaging server must utilize encryption when using LDAP for authentication.
  • V-255799CAT IIThe MQ Appliance messaging server must map the authenticated identity to the individual messaging user or group account for PKI-based authentication.
  • V-255800CAT IIThe MQ Appliance must disable identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
  • V-255801CAT IIThe MQ Appliance messaging server must use an enterprise user management system to uniquely identify and authenticate users (or processes acting on behalf of organizational users).
  • V-255802CAT IIThe MQ Appliance messaging server management interface must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.
  • V-255803CAT IIThe MQ Appliance messaging server must generate log records for access and authentication events.
  • V-255804CAT IIThe MQ Appliance messaging server must ensure authentication of both SSH client and server during the entire session.
  • V-255805CAT IIThe MQ Appliance messaging server must generate a unique session identifier using a FIPS 140-2 approved random number generator.
  • V-255806CAT IIThe MQ Appliance messaging server must authenticate all network-connected endpoint devices before establishing any connection.
  • V-255807CAT IThe MQ Appliance messaging server must authenticate all endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
  • V-255808CAT IIMQ Appliance messaging servers must use NIST-approved or NSA-approved key management technology and processes.
  • V-255809CAT IIThe MQ Appliance messaging server must utilize FIPS 140-2 approved encryption modules when authenticating users and processes.
  • V-255810CAT IIThe MQ Appliance messaging server must protect the confidentiality and integrity of transmitted information through the use of an approved TLS version.
  • V-255811CAT IIThe MQ Appliance messaging server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
  • V-255812CAT IIThe MQ Appliance messaging server must employ approved cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.
  • V-255813CAT IIThe MQ Appliance messaging server must provide a clustering capability.
  • V-255814CAT IIThe MQ Appliance messaging server must provide centralized management and configuration of the content to be captured in log records generated by all application components.
  • V-255815CAT IIThe MQ Appliance messaging server must, at a minimum, transfer the logs of interconnected systems in real time, and transfer the logs of standalone systems weekly.
  • V-255816CAT IIThe MQ Appliance messaging server must use encryption strength in accordance with the categorization of the management data during remote access management sessions.
  • V-255817CAT IIThe MQ Appliance messaging server, when categorized as a high level system, must be in a high-availability (HA) cluster.

Removed since V1R1 (43)

  • V-74727CAT IIThe MQ Appliance messaging server must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
  • V-74729CAT IIThe MQ Appliance messaging server must implement cryptography mechanisms to protect the integrity of the remote access session.
  • V-74741CAT IIThe MQ Appliance messaging server must off-load log records onto a different system or media from the system being logged.
  • V-74743CAT IIIThe MQ Appliance messaging server must synchronize internal MQ Appliance messaging server clocks to an authoritative time source when the time difference is greater than the organization-defined time period.
  • V-74745CAT IIIThe MQ Appliance messaging server must compare internal MQ Appliance messaging server clocks at least every 24 hours with an authoritative time source.
  • V-74747CAT IIThe MQ Appliance messaging server must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
  • V-74749CAT IIThe MQ Appliance WebGUI interface to the messaging server must prohibit the use of cached authenticators after one hour.
  • V-74801CAT IIThe MQ Appliance messaging server must provide an immediate warning to the SA and ISSO, at a minimum, when allocated log record storage volume reaches 75% of maximum log record storage capacity.
  • V-74805CAT IIThe MQ Appliance messaging server must automatically terminate a SSH user session after organization-defined conditions or trigger events requiring a session disconnect.
  • V-74813CAT IIThe MQ Appliance must automatically terminate a WebGUI user session after 600 seconds of idle time.
  • V-74815CAT IIThe MQ Appliance SSH interface to the messaging server must prohibit the use of cached authenticators after 600 seconds.
  • V-74831CAT IIThe MQ Appliance messaging server must install security-relevant software updates within the time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).
  • V-74835CAT IIThe MQ Appliance messaging server must use DoD- or CNSS-approved PKI Class 3 or Class 4 certificates.
  • V-74847CAT IIThe MQ Appliance messaging server, when categorized as a high level system, must be in a high-availability (HA) cluster.
  • V-74849CAT IIThe MQ Appliance messaging server must use encryption strength in accordance with the categorization of the management data during remote access management sessions.
  • V-74851CAT IIThe MQ Appliance messaging server must, at a minimum, transfer the logs of interconnected systems in real time, and transfer the logs of standalone systems weekly.
  • V-74853CAT IIThe MQ Appliance messaging server must provide centralized management and configuration of the content to be captured in log records generated by all application components.
  • V-74859CAT IIThe MQ Appliance messaging server must employ approved cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.
  • V-74861CAT IIThe MQ Appliance messaging server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
  • V-74863CAT IIThe MQ Appliance messaging server must protect the confidentiality and integrity of transmitted information through the use of an approved TLS version.
  • V-74877CAT IIThe MQ Appliance messaging server must produce log records containing information to establish what type of events occurred.
  • V-74879CAT IIThe MQ Appliance messaging server must identify potentially security-relevant error conditions.
  • V-74883CAT IIThe MQ Appliance messaging server must alert the SA and ISSO, at a minimum, in the event of a log processing failure.
  • V-74885CAT IIThe MQ Appliance messaging server must protect against or limit the effects of all types of Denial of Service (DoS) attacks by employing operationally-defined security safeguards.
  • V-74887CAT IIIThe MQ Appliance messaging server must accept FICAM-approved third-party credentials.
  • V-74889CAT IIThe MQ Appliance messaging server must provide a log reduction capability that supports on-demand reporting requirements.
  • V-74891CAT IIThe MQ Appliance messaging server must be configured to fail over to another system in the event of log subsystem failure.
  • V-74893CAT IIThe MQ Appliance messaging server must provide a clustering capability.
  • V-74895CAT IIThe MQ Appliance messaging server must ensure authentication of both SSH client and server during the entire session.
  • V-74897CAT IIThe MQ Appliance messaging server must uniquely identify all network-connected endpoint devices before establishing any connection.
  • V-74899CAT IIAccess to the MQ Appliance messaging server must utilize encryption when using LDAP for authentication.
  • V-74901CAT IIThe MQ Appliance messaging server must map the authenticated identity to the individual messaging user or group account for PKI-based authentication.
  • V-74903CAT IIThe MQ Appliance must disable identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.
  • V-74905CAT IIThe MQ Appliance messaging server must use an enterprise user management system to uniquely identify and authenticate users (or processes acting on behalf of organizational users).
  • V-74907CAT IIThe MQ Appliance messaging server management interface must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.
  • V-74909CAT IIThe MQ Appliance messaging server must generate log records for access and authentication events.
  • V-74911CAT IIThe MQ Appliance messaging server must generate a unique session identifier using a FIPS 140-2 approved random number generator.
  • V-74913CAT IIThe MQ Appliance messaging server must authenticate all network-connected endpoint devices before establishing any connection.
  • V-74915CAT IThe MQ Appliance messaging server must authenticate all endpoint devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
  • V-74917CAT IIMQ Appliance messaging servers must use NIST-approved or NSA-approved key management technology and processes.
  • V-74919CAT IIThe MQ Appliance messaging server must utilize FIPS 140-2 approved encryption modules when authenticating users and processes.
  • V-74921CAT IIThe MQ Appliance messaging server must provide access logging that ensures users who are granted a privileged role (or roles) have their privileged activity logged.
  • V-75029CAT IIThe MQ Appliance messaging server must only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected (messaging) sessions.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.