Ensure that listeners negotiate only approved cipher suites with clients.
Enforce Minimum TLS Policy
CCC.LB.CN17 · Encryption
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP01 | Encryption in Transit Enabled by Default | The service automatically encrypts all data using industry-standard cryptographic protocols prior to transmission via a network interface. |
| CCC.Core.CP08 | Data Replication | The service automatically replicates data across multiple deployments simultaneously with parity, or may be configured to do so. |
| CCC.Core.CP14 | API Access | The service exposes a port enabling external actors to interact programmatically with the service and its resources using HTTP protocol methods such as GET, POST, PUT, and DELETE. |
| CCC.LB.CP11 | SSL/TLS Termination | The service can decrypt SSL or TLS encrypted traffic at the load balancer rather than at the backend servers, offloading the decryption task from the backend servers. |
| CCC.LB.CP24 | Configurable TLS Policy | The service may be configured with a TLS policy that sets the minimum protocol version and the permitted cipher suites negotiated with clients. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.Core.TH02 | Data is Intercepted in Transit | Data transmitted by the service is susceptible to collection by any entity with access to any part of the transmission path. Packet observations can be used to support the planning of attacks by profiling origin points, destinations, and usage patterns. The data may also be vulnerable to interception or modification in transit if not properly encrypted, impacting the confidentiality or integrity of the transmitted data. |
| CCC.LB.TH08 | Weak TLS Policy Permits Protocol Downgrade | The TLS policy on a listener may be configured to accept deprecated protocol versions or weak cipher suites. Clients can then be forced into a downgraded handshake and the session decrypted or modified by an entity on the transmission path, compromising the confidentiality and integrity of the data in transit. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.LB.CN17.AR02 | When a TLS or HTTPS listener is configured, its TLS policy MUST permit only cipher suites on the organization's approved list. | tlp-green, tlp-amber, tlp-red |