Ensure that requests remain encrypted between the load balancer and its backend targets after TLS termination.
Encrypt Traffic to Backend Targets
CCC.LB.CN12 · Encryption
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.LB.CP11 | SSL/TLS Termination | The service can decrypt SSL or TLS encrypted traffic at the load balancer rather than at the backend servers, offloading the decryption task from the backend servers. |
| CCC.LB.CP25 | Backend Re-encryption | The service can re-encrypt traffic to backend targets after terminating TLS at the load balancer, so that data stays encrypted end to end. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.LB.TH09 | Traffic to Backend Targets Is Forwarded Unencrypted | When TLS is terminated at the load balancer and backend re-encryption is not configured, requests are forwarded to targets in cleartext. Any entity with access to the internal network path between the load balancer and the targets can read or alter the traffic, compromising the confidentiality and integrity of the data. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.LB.CN12.AR01 | When TLS is terminated at the load balancer, the backend protocol for every target group or backend pool MUST be HTTPS or TLS. | tlp-amber, tlp-red |