2.2.7 All non-console administrative access is encrypted using strong cryptography.

Defined Approach Requirements

2.2.7 All non-console administrative access is encrypted using strong cryptography.

Customized Approach Objective

Unauthorized individuals cannot view or collect data transmitted during administration of system components.

Applicability Notes

This includes administrative access via browser-based interfaces and application programming interfaces (APIs).

Defined Approach Testing Procedures

2.2.7.a Examine system configuration standards to verify they require all non-console administrative access to be encrypted with strong cryptography.

2.2.7.b Observe an administrator log on to system components and examine system configurations to verify that non-console administrative access is encrypted with strong cryptography.

Purpose

If non-console (including remote) administration does not use secure authentication and encrypted communications, sensitive administrative or operational information (like administrator passwords) can be revealed to an eavesdropper. A malicious individual could use this information to access the network, become administrator, and steal data.

Good Practice

Clear-text protocols such as HTTP, Telnet, or rlogin should never be used for administrative access.

Technologies for non-console administrative access include, but are not limited to, SSH, VPN, or TLS for web-based management and other non-console administrative access.