Disable insecure TLS versions
Summary
The system must disable out-of-date or insecure versions of SSL and TLS protocols, algorithms and ciphers.
Description
All communications between the client and the server should take place over channels that are protected and encrypted. In order to guarantee this, out-of-date or insecure protocols such as SSLv2, SSLv3, or TLS 1.0 and TLS 1.1 should be disabled. The latest version of TLS should be used and communications should not be allowed to fall back on insecure or unencrypted protocols.
Supported In
This requirement is verified in following services:
| Plan | Supported |
|---|---|
| Machine | 🟢 |
| Squad | 🟢 |
References
- CAPEC™-94. Adversary in the middle (AiTM)
- CAPEC™-117. Interception
- CAPEC™-212. Functionality misuse
- CAPEC™-216. Communication channel manipulation
- CAPEC™-272. Protocol manipulation
- CAPEC™-594. Traffic injection
- OWASP TOP 10-A2. Cryptographic failures
- OWASP-M TOP 10-M3. Insecure communication threat agents
- NIST Framework-PR_PT-4. Communications and control networks are protected
- CERT-J-DRD19-J. Properly verify server certificate on SSL/TLS
- MITRE ATT&CK®-M1020. SSL/TLS inspection
- PA-DSS-5_2_4. Insecure communications
- PA-DSS-12_1. Encrypt all nonconsole administrative access with strong cryptography
- CMMC-AC_L2-3_1_13. Remote access confidentiality
- CMMC-MP_L2-3_8_6. Portable storage encryption
- CMMC-SC_L1-3_13_1. Boundary protection
- HITRUST CSF-01_x. Mobile computing and communications
- HITRUST CSF-01_y. Teleworking
- HITRUST CSF-09_s. Information exchange policies and procedures
- FedRAMP-CA-3_3. Unclassified non-national security system connections
- FedRAMP-SC-8. Transmission confidentiality and integrity
- WASSEC-1_1. Transport support
- WASSEC-6_2_1_4. Authentication - Lack of SSL on login pages
- OSSTMM3-9_7_4. Wireless security (controls verification) - Integrity
- OSSTMM3-10_7_3. Telecommunications security (controls verification) - Privacy
- OSSTMM3-11_7_3. Data networks security (controls verification) - Privacy
- WASC-W_04. Insufficient transport layer protection
- ISSAF-H_14_17. Network security - Intrusion detection (detection engine)
- ISSAF-T_14_1. Web application assessment - URL manipulation
- ISSAF-T_19_1. Web application assessment - Global Countermeasures (client-side)
- PTES-4_5_3. Threat capability analysis - Communication mechanisms
- MVSP-2_2. Application design controls - HTTPS only
- MVSP-2_8. Application design controls - Encryption
- OWASP SCP-9. Communication security
- OWASP MASVS-V5_1. Network communication requirements
- SWIFT CSCF-2_6. Operator session confidentiality and integrity
- OWASP ASVS-1_9_2. Communications architecture
- OWASP ASVS-9_1_1. Client communication security
- OWASP ASVS-9_1_3. Client communication security
- SIG Core-I_3_2_4_1. Application security
- CWE™-5. Data transmission without encryption
- OWASP ASVS-9_1_2. Client communication security
- OWASP ASVS-13_2_6. RESTful web service
- CASA-9_1_2. Client Communication Security
- CASA-9_1_3. Client Communication Security
Vulnerabilities
- 016. Insecure encryption algorithm - SSL/TLS
- 052. Insecure encryption algorithm
- 092. Insecure encryption algorithm - Anonymous cipher suites
- 094. Insecure encryption algorithm - Cipher Block Chaining
- 133. Insecure encryption algorithm - Perfect Forward Secrecy
- 147. Insecure encryption algorithm - SSLContext
Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.