IIST-SI-000242 - The IIS 10.0 private website must employ cryptographic mechanisms (TLS) and require client certificates.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

Information

TLS encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2/140-3 approved TLS version, and all non-FIPS-approved SSL versions must be disabled.

NIST SP 800-52 specifies the preferred configurations for government systems.

Solution

Follow the procedures below for each site hosted on the IIS 10.0 web server:

Open the IIS 10.0 Manager.

Double-click the 'SSL Settings' icon under the 'IIS' section.

Select the 'Require SSL' setting.

Select the 'Client Certificates Required' setting.

Click 'Apply' in the 'Actions' pane.

Click the site under review.

Select 'Configuration Editor' under the 'Management' section.

From the 'Section:' drop-down list at the top of the configuration editor, locate 'system.webServer/security/access'.

Click on the drop-down list for 'sslFlags'.

Select the 'Ssl128' check box.

Click 'Apply' in the 'Actions' pane.

Item Details

Audit Name: DISA IIS 10.0 Site v2r13

Plugin: Windows

Control ID: ac7bbb00b72b7067efddd53aa302bb0eeba3332d64c36221d8138eee0608ce7a

Detections

Analytics

IIST-SI-000242 - The IIS 10.0 private website must employ cryptographic mechanisms (TLS) and require client certificates.

Warning! Audit Deprecated

Information

Solution

See Also

Item Details