4

I just stumbled upon this fedramp document: https://www.fedramp.gov/assets/resources/templates/FedRAMP-Moderate-Readiness-Assessment-Report-(RAR)-Template.docx

It contains the following note in 4.2.2 Transport Layer Security:

Note: DHS BOD 18-01 disallows TLS 1.2 via HTTP Strict Transport Security (HSTS).

I am genuinely surprised that you can't use TLS 1.2 in combination with HSTS. From my perspective I think that better advice would be to maintain HSTS and use TLS 1.3. i.e. there is no benefit in disabling HSTS, it is quite the opposite.

Does someone know the reasoning behind this?

Improve this question
2
  • 3
    That's strange. I cannot find any such requirement in BOD 18-01.
    – Steffen Ullrich
    Commented Feb 5 at 15:37
  • 2
    I'm equally lost. I combed through the supporting docs and couldn't find anything to support this note. I would conclude that this note is an error.
    – schroeder ♦
    Commented Feb 5 at 16:03

1 Answer 1

Reset to default
2

The statement relies on how it's read and knowing what's missing in it. The keyword for the statement is 'via.' When I first read it, I read 'via' but thought 'and.' My understanding is, in "government/legalese" it's inferring that you cannot implement TLS 1.2 by using HSTS to redirect from HTTP because HTTP usage is no longer allowed for US Federal sites.

Here's my interpretation:

First, it's explicitly citing TLS 1.2 because that's the required version of TLS for FedRAMP. TLS 1.3 is allowed but not expected yet.

While TLS 1.2 and above are required at the protocol level 1

Second, The US Government ordered that HTTPS be the only means of accessing Federal websites. In BOD-18-01, under B. Web Security it states:

In 2015, OMB M-15-13 required all existing Federal websites and web services to be accessible through a secure connection (HTTPS-only, with HSTS). 2

Notice the HTTPS-only, with HSTS in that statement. That same policy requires all new US Government websites to be HTTPS-only.

The last point is that the Federal Government has started using the preloaded HSTS policy introduced in browsers to ensure HSTS is implemented.3

Wrapping it all up, you must use HSTS and TLS 1.2. You cannot redirect HTTP to TLS 1.2 using (via) HSTS.

References

FedRAMP FAQ - Security
BOD-18-01
HSTS Preloading

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .