Disable insecure TLS versions

Summary

The system must disable out-of-date or insecure versions of SSL and TLS protocols, algorithms and ciphers.

Description

All communications between the client and the server should take place over channels that are protected and encrypted. In order to guarantee this, out-of-date or insecure protocols such as SSLv2, SSLv3, or TLS 1.0 and TLS 1.1 should be disabled. The latest version of TLS should be used and communications should not be allowed to fall back on insecure or unencrypted protocols.

Supported In

This requirement is verified in following services

Plan	Supported
Essential	🟢
Advanced	🟢

References

• CAPEC™-94. Adversary in the middle (AiTM)
• CAPEC™-117. Interception
• CAPEC™-212. Functionality misuse
• CAPEC™-216. Communication channel manipulation
• CAPEC™-272. Protocol manipulation
• CAPEC™-594. Traffic injection
• OWASP TOP 10-A2. Cryptographic failures
• OWASP-M TOP 10-M3. Insecure communication threat agents
• CERT-J-DRD19-J. Properly verify server certificate on SSL/TLS
• MITRE ATT&CK®-M1020. SSL/TLS inspection
• PA-DSS-5_2_4. Insecure communications
• PA-DSS-12_1. Encrypt all nonconsole administrative access with strong cryptography
• CMMC-AC_L2-3_1_13. Remote access confidentiality
• CMMC-MP_L2-3_8_6. Portable storage encryption
• CMMC-SC_L1-3_13_1. Boundary protection
• HITRUST CSF-01_x. Mobile computing and communications
• HITRUST CSF-01_y. Teleworking
• HITRUST CSF-09_s. Information exchange policies and procedures
• FedRAMP-CA-3_3. Unclassified non-national security system connections
• FedRAMP-SC-8. Transmission confidentiality and integrity
• WASSEC-1_1. Transport support
• WASSEC-6_2_1_4. Authentication - Lack of SSL on login pages
• OSSTMM3-9_7_4. Wireless security (controls verification) - Integrity
• OSSTMM3-10_7_3. Telecommunications security (controls verification) - Privacy
• OSSTMM3-11_7_3. Data networks security (controls verification) - Privacy
• WASC-W_04. Insufficient transport layer protection
• ISSAF-H_14_17. Network security - Intrusion detection (detection engine)
• ISSAF-T_14_1. Web application assessment - URL manipulation
• ISSAF-T_19_1. Web application assessment - Global Countermeasures (client-side)
• PTES-4_5_3. Threat capability analysis - Communication mechanisms
• MVSP-2_2. Application design controls - HTTPS only
• MVSP-2_8. Application design controls - Encryption
• OWASP SCP-9. Communication security
• SWIFT CSCF-2_6. Operator session confidentiality and integrity
• OWASP ASVS-1_9_2. Communications architecture
• OWASP ASVS-9_1_1. Client communication security
• OWASP ASVS-9_1_3. Client communication security
• SIG Core-I_3_2_4_1. Application security
• CWE™-5. Data transmission without encryption
• OWASP ASVS-9_1_2. Client communication security
• OWASP ASVS-13_2_6. RESTful web service
• CASA-9_1_2. Client Communication Security
• CASA-9_1_3. Client Communication Security
• OWASP MASVS-NETWORK-1. The app secures all network traffic according to the current best practices

Vulnerabilities

• 016. Insecure encryption algorithm - SSL/TLS
• 052. Insecure encryption algorithm
• 092. Insecure encryption algorithm - Anonymous cipher suites
• 094. Insecure encryption algorithm - Cipher Block Chaining
• 133. Insecure encryption algorithm - Perfect Forward Secrecy
• 147. Insecure encryption algorithm - SSLContext

free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.