The container platform must use a FIPS-validated cryptographic module to implement encryption services for unclassified information requiring confidentiality.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
high	V-233289	SRG-APP-000635	SRG-APP-000635-CTR-001405	SV-233289r961908_rule	2024-12-05	2

Description
Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard. Cryptographic module used must have one FIPS-validated encryption algorithm (i.e., validated Advanced Encryption Standard [AES]). This validated algorithm must be used for encryption for cryptographic security function within the container platform component and information residing in the container platform registry and keystore.

Description

Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2 standard. Cryptographic module used must have one FIPS-validated encryption algorithm (i.e., validated Advanced Encryption Standard [AES]). This validated algorithm must be used for encryption for cryptographic security function within the container platform component and information residing in the container platform registry and keystore.

ℹ️ Check
Review the container platform configuration to ensure FIPS-validated cryptographic modules are implemented to encrypt unclassified information requiring confidentiality. If FIPS-validated cryptographic modules are not being used, this is a finding.

✔️ Fix
Configure the container platform to use FIPS-validated cryptographic modules to encrypt unclassified information requiring confidentiality.