Checklist Summary:

The Redis Enterprise 6.x Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. This document is meant to be used in conjunction with the Red Hat Enterprise Linux STIG (operating system STIG), network STIG, and other STIGs applicable to the database host environment. It is based on the Database Security Requirements Guide (SRG), which in turn derives its cybersecurity controls from National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 4. Redis Enterprise is a real-time data platform built by Redis Labs, the same entity that developed open-source Redis. It maintains the simplicity and performance of Redis while adding enterprise-grade security, scalability, high availability, Active-Active geo-replication, and deployment options over multiple platforms on-premises, across clouds, and in hybrid deployments. Redis is a NoSQL data store that maintains a key/value relationship in memory to achieve this performance. It can be used as a database, cache, or message store. This STIG requires that the product be deployed on a FIPS-compliant, cryptography-enabled operating system found in the Cryptographic Module Validation Program (https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules) or by other means to ensure that FIPS 140-2-certified OpenSSL libraries are used by the database management system (DBMS). Note: Failure to enforce FIPS 140-2 on the underlying OS will result in multiple findings for the RMF accreditation package. One finding, within the respective OS SRG or STIG, relates to how the OS communicates (security updates, privileged access, service accounts) as the underlying infrastructure. The second finding relates to how the application owner or DB administrator can establish secure communications and protect data. The OS and DB are independent resources, each with their own set of privileged users who may be accessing the platform for different reasons. However, the DB is not distributed with its own FIPS 140-2 crypto module (relying instead on the underlying OS); a misconfigured OS for FIPS 140-2 will result in two findings wherever Redis is installed.

Checklist Role:

• Database Management System

Known Issues:

Not provided.

Target Audience:

Parties within the DoD and Federal Government’s computing environments can obtain the applicable STIG from the Cyber Exchange website at https://cyber.mil/. This site contains the latest copies of STIGs, SRGs, and other related security information. Those without a Common Access Card (CAC) that has DoD Certificates can obtain the STIG from https://public.cyber.mil/.

Target Operational Environment:

• Managed
• Specialized Security-Limited Functionality (SSLF)

Testing Information:

Not provided.

Regulatory Compliance:

DoD Instruction (DoDI) 8500.01

Comments/Warnings/Miscellaneous:

All technical NIST SP 800-53 requirements were considered while developing this STIG. Requirements that are applicable and configurable will be included in the final STIG. A report marked Controlled Unclassified Information (CUI) will be available for those items that did not meet requirements. This report will be available to component Authorizing Official (AO) personnel for risk assessment purposes by request via email to: disa.stig_spt@mail.mil.

Disclaimer:

Not provided.

Product Support:

Parties within the DoD and Federal Government’s computing environments can obtain the applicable STIG from the Cyber Exchange website at https://cyber.mil/. This site contains the latest copies of STIGs, SRGs, and other related security information. Those without a Common Access Card (CAC) that has DoD Certificates can obtain the STIG from https://public.cyber.mil/.

Point of Contact:

disa.stig_spt@mail.mil

Sponsor:

Not provided.

Licensing:

Not provided.

Change History:

update to FINAL - 1/20/2022
Updated resource per DISA - 10/26/22
updated URLs - 1/26/24

Dependency/Requirements:

URL	Description

References:

Reference URL	Description

NIST checklist record last modified on 01/26/2024