1

My environment has a variety of operating systems (Windows, Linux, etc.), servers and applications. Infrastructure scans are showing old versions of TLS that need to be disabled at the OS level, while DAST scans are likewise showing old versions of TLS that need to be disabled on the application/server level.

What would be the difference or benefit of disabling old TLS versions at both the OS level and the server level? Are the two independent of one another?

1 Answer 1

3

An OS will usually provide system-wide libraries that offer TLS APIs to be used by programs. For example SChannel for Windows, openssl for linux and libressl for openbsd, just to name a few.

However, a client or server program may choose to use its own TLS implementation (e.g. java programs using the Java Cryptography Architecture), or it may be statically linked with a crypto library and ignore the system-wide ones.

Normally if you don't want to allow the use of older TLS versions, you should disable them at both levels because:

  • if you disable them at the OS level but allow (server) applications to use the old versions, then you still permit exploitation
  • if you don't disable them at the OS level, programs that depend on the system-wide libraries may use an insecure TLS version
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .