← Back to General Application (GAPP) Security Requirements Guide

V-288256

CAT I (High)

The application must prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.

Rule ID

SV-288256r1252887_rule

STIG

General Application (GAPP) Security Requirements Guide

Version

V1R0.1

CCIs

CCI-001453

Discussion

Using older unauthorized versions or incorrectly configuring protocol negotiation makes the gateway vulnerable to known and unknown attacks that exploit vulnerabilities in this protocol. This requirement applies to Transport Layer Security (TLS) gateways (also known as Secure Sockets Layer [SSL] gateways), web servers, and web applications. Application protocols such as HTTPS and DNSSEC use TLS as the underlying security protocol and thus are in scope for this requirement. NIST SP 800-52 provides guidance for client negotiation, either on DoW-only or on public-facing servers.

Check Content

Review the application documentation and deployed configuration to determine whether the application's cryptography mechanism prohibits client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.

If the application's cryptography mechanism does not prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0, this is a finding.

Fix Text

Navigate to the cryptography configuration within the application.

Configure the application's cryptography mechanism to prohibit client negotiation to TLS 1.1, TLS 1.0, SSL 2.0, or SSL 3.0.