Summary

The system must disable out-of-date or insecure versions of SSL and TLS protocols, algorithms and ciphers.

Description

All communications between the client and the server should take place over channels that are protected and encrypted. In order to guarantee this, out-of-date or insecure protocols such as SSLv2, SSLv3, or TLS 1.0 and TLS 1.1 should be disabled. The latest version of TLS should be used and communications should not be allowed to fall back on insecure or unencrypted protocols.

References

• CAPEC-94. Adversary in the middle (AiTM)
• CAPEC-117. Interception
• CAPEC-212. Functionality misuse
• CAPEC-216. Communication channel manipulation
• CAPEC-272. Protocol manipulation
• CAPEC-594. Traffic injection
• OWASP10-A2. Cryptographic failures
• OWASPM10-M3. Insecure communication threat agents
• CERTJ-DRD19-J. Properly verify server certificate on SSL/TLS
• MITRE-M1020. SSL/TLS inspection
• PADSS-5_2_4. Insecure communications
• PADSS-12_1. Encrypt all nonconsole administrative access with strong cryptography
• CMMC-AC_L2-3_1_13. Remote access confidentiality
• CMMC-MP_L2-3_8_6. Portable storage encryption
• CMMC-SC_L1-3_13_1. Boundary protection
• HITRUST-01_x. Mobile computing and communications
• HITRUST-01_y. Teleworking
• HITRUST-09_s. Information exchange policies and procedures
• FEDRAMP-CA-3_3. Unclassified non-national security system connections
• FEDRAMP-SC-8. Transmission confidentiality and integrity
• WASSEC-1_1. Transport support
• WASSEC-6_2_1_4. Authentication - Lack of SSL on login pages
• OSSTMM3-9_7_4. Wireless security (controls verification) - Integrity
• OSSTMM3-10_7_3. Telecommunications security (controls verification) - Privacy
• OSSTMM3-11_7_3. Data networks security (controls verification) - Privacy
• WASC-W_04. Insufficient transport layer protection
• ISSAF-H_14_17. Network security - Intrusion detection (detection engine)
• ISSAF-T_14_1. Web application assessment - URL manipulation
• ISSAF-T_19_1. Web application assessment - Global Countermeasures (client-side)
• PTES-4_5_3. Threat capability analysis - Communication mechanisms
• MVSP-2_2. Application design controls - HTTPS only
• MVSP-2_8. Application design controls - Encryption
• OWASPSCP-9. Communication security
• SWIFTCSC-2_6. Operator session confidentiality and integrity
• ASVS-1_9_2. Communications architecture
• ASVS-9_1_1. Client communication security
• ASVS-9_1_3. Client communication security
• SIG-I_3_2_4_1. Application security
• CWE-5. Data transmission without encryption
• ASVS-9_1_2. Client communication security
• ASVS-13_2_6. RESTful web service
• CASA-9_1_2. Client Communication Security
• CASA-9_1_3. Client Communication Security
• OWASPMASVS-NETWORK-1. The app secures all network traffic according to the current best practices

Weaknesses

• 016. Insecure encryption algorithm - SSL/TLS
• 052. Insecure encryption algorithm
• 092. Insecure encryption algorithm - Anonymous cipher suites
• 094. Insecure encryption algorithm - Cipher Block Chaining
• 133. Insecure encryption algorithm - Perfect Forward Secrecy
• 147. Insecure encryption algorithm - SSLContext