SOL-11.1-060150 - The operating system must employ cryptographic mechanisms to protect information in storage.

Information

When data is written to digital media, such as hard drives, mobile computers, external/removable hard drives, personal digital assistants, flash/thumb drives, etc., there is risk of data loss and data compromise.

An organizational assessment of risk guides the selection of media and associated information contained on the media requiring restricted access. Organizations need to document in policy and procedures the media requiring restricted access, individuals authorized to access the media, and the specific measures taken to restrict access.

Fewer protection measures are needed for media containing information determined by the organization to be in the public domain, to be publicly releasable, or to have limited or no adverse impact if accessed by other than authorized personnel. In these situations, it is assumed the physical access controls where the media resides provide adequate protection.

As part of a defense-in-depth strategy, the organization considers routinely encrypting information at rest on selected secondary storage devices. The employment of cryptography is at the discretion of the information owner/steward. The selection of the cryptographic mechanisms used is based upon maintaining the confidentiality and integrity of the information.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

The ZFS file system management profile is required.

ZFS file system encryption may only be enabled on creation of the file system. If a file system must be encrypted and is not, its data should be archived, it must be removed and re-created.

First, stop running applications using the file systems, archive the data, unmount, and then remove the file system.

# umount [file system name]
# zfs destroy [file system name]

When creating ZFS file systems, ensure that they are created as encrypted file systems.

# pfexec zfs create -o encryption=on [file system name]
Enter passphrase for '[file system name]': xxxxxxx
Enter again: xxxxxxx

Store the passphrase in a safe location. The passphrase will be required to mount the file systems upon system reboot. If automated mounting is required, the passphrase must be stored in a file.

Item Details

Audit Name: DISA Solaris 11 SPARC STIG v3r3

Category: SYSTEM AND COMMUNICATIONS PROTECTION

Plugin: Unix

Control ID: db0fb0dfe39b6644412ee387c3d58b8c4b85a0476d6493273f03103f0821d43c

Detections

Analytics

SOL-11.1-060150 - The operating system must employ cryptographic mechanisms to protect information in storage.

Information

Solution

See Also

Item Details