F5 NGINX Security Technical Implementation Guide

Version: 1

Updated: 08 Jan 2026

Findings: 32

Findings

V-278380 - NGINX must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types. (medium)
V-278381 - NGINX must use TLS 1.2, at a minimum, to protect data confidentiality using remote access. (high)
V-278382 - The NGINX service account must be configured to not have shell access. (medium)
V-278383 - The NGINX service account must be configured to not have admin group access. (medium)
V-278384 - NGINX must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the application. (medium)
V-278385 - NGINX must provide audit records for DOD-defined auditable events. (medium)
V-278386 - NGINX must allow only the information system security manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited. (medium)
V-278387 - NGINX must prevent the execution of unapproved modules. (medium)
V-278388 - NGINX must protect audit information from unauthorized access. (medium)
V-278389 - NGINX must be configured to prohibit or restrict using ports, protocols, and/or services. (medium)
V-278390 - NGINX must implement replay-resistant authentication mechanisms for network access. (medium)
V-278391 - NGINX must be configured to use a Certificate Revocation List (CRL) for certificate path validation and revocation. (Online Certificate Status Protocol [OCSP] is the preferred configuration.) (medium)
V-278392 - NGINX, when using PKI-based authentication, must enforce authorized access to the corresponding private key. (medium)
V-278393 - NGINX must identify prohibited mobile code. (medium)
V-278394 - NGINX must restrict the ability of individuals to launch denial-of-service (DoS) attacks against other information systems. (medium)
V-278395 - NGINX must generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries. (medium)
V-278396 - NGINX must off-load audit records to a central log server. (high)
V-278397 - NGINX must restrict access to configuration files. (medium)
V-278398 - NGINX must be configured with a deny-all, permit-by-exception policy to allow the execution of authorized software programs. (medium)
V-278399 - NGINX must be configured to require SSL sessions to reauthenticate no longer than 15 minutes. (medium)
V-278400 - NGINX must accept Personal Identity Verification (PIV) credentials. (medium)
V-278401 - NGINX must be configured to expire cached authenticators after an organization-defined time period. (medium)
V-278402 - NGINX must be configured to pass security attributes to proxies. (medium)
V-278403 - NGINX must only allow using DOD approved certificate authorities for PKI. (medium)
V-278404 - NGINX must protect against denial-of-service (DoS) attacks. (medium)
V-278405 - NGINX must be configured to use FIPS-approved algorithms to protect the confidentiality and integrity of transmitted information. (medium)
V-278406 - NGINX must be configured to use Online Certificate Status Protocol (OCSP) for certificate path validation and revocation. (OCSP is the preferred configuration.) (medium)
V-278407 - NGINX must be configured to use a FIPS-validated cryptographic module for confidentiality and integrity. (medium)
V-278408 - The NGINX service account must be configured to lock changes to the password. (medium)
V-278409 - NGINX must separate API maintenance sessions from other network sessions within the system by logically separated communications paths. (medium)
V-278410 - NGINX must generate, manage, and protect from disclosure and misuse the cryptographic keys that protect access tokens. (medium)
V-278411 - NGINX must revoke access tokens in accordance with organization-defined identification and authentication policy. (medium)