Linked Questions

0
votes
1answer
585 views

Network security question (NLB and 2-way TLS) [duplicate]

I have a situation that can be better illustrated in the network diagram below. My scenario: Client Web Server (external party) is using TLS 1.2. In my network, My Web Server is fronted by a NLB (...
0
votes
1answer
84 views

Better protocol for Web app [duplicate]

I have many Web applications developed as Node.js based servers horizontally scaled with a Load Balancer in front of them. At the beginning all my Web applications exposed HTTP endpoints and the Load ...
287
votes
3answers
69k views

CRIME - How to beat the BEAST successor?

With the advent of CRIME, BEAST's successor, what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?
24
votes
3answers
18k views

Is there a way to mitigate BEAST without disabling AES completely?

It seems that the easiest way to protect users against the BEAST attack on TLS <= 1.0 is to prefer RC4 or even disable all other (CBC) cipher suites altogether, e.g. by specifying something like ...
17
votes
3answers
6k views

Is SSL terminated at a load balancer PCI compliant?

I've read this nice question: Should SSL be terminated at a load balancer? And I have the same question, but with PCI-DSS compliance in mind. Is SSL terminated at the load balancer, with clear ...
5
votes
7answers
7k views

How can a non-technical user verify a message was sent “securely”? …or over TLS?

I have a situation where B2B and B2C communication needs to be sent securely and not visible to most SMTP hijackers. I don't care about conspiracy theories or NSA style attacks, but want to provide ...
8
votes
2answers
16k views

How to mitigate SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability?

Disclaimer: I'm not a sysadmin, please try to give your answers in developer friendly language ;) I'm test scanning a fresh VPS image with Nessus and I'm getting plugin 58751. I tried figuring out ...
5
votes
1answer
1k views

IIS 6.0 - mitigating BEAST

Recently, my PCI assessor informed me that my servers are vulnerable to BEAST and failed me. I did my homework and I want to change our webservers to prefer RC4 ciphers over CBC. I followed every ...
2
votes
1answer
1k views

What's the use of certificate on Load Balancer and Keystore on Service?

Consider a scenario where my service is using a keystore made of self signed cerificate and the load balancer which is balancing traffic for service is binded with a CA approved certificate. I would ...
2
votes
3answers
210 views

Multiple SSL Inspection

I want to ask you if you think that doing SSL Inspection in proxy mode (Resign) could be a problem. The scenario is the following: 1 --> 2 --> 3 Client web browsing IPS device with SSL ...
1
vote
1answer
80 views

Is there a vulnerability when TLS is decrypted, then encrypted with OpenSSL that is vulnerable to BEAST or CRIME?

Assume that the following TLS proxy exists User <-----> Load Balancer that decrypts, encrypts <------> WebServer Where the web server is running a vulnerable version of OpenSSL. Can ...
2
votes
1answer
86 views

Security implications of client TLS termination

I have a bunch of HTTP services/devices TLS unaware. I want to allow them to access WAN, but of course I do not want them to do it in plain HTTP. Updating them is unworkable due to legacy issues and ...
0
votes
1answer
79 views

Storage of SSL private key in load balancer VS HSM

I have a setup whereby the SSL certificates are terminated at the load balancer (i.e. Load balancer to web server is in plaintext). In order to do the SSL termination, the private key is stored on the ...
0
votes
1answer
55 views

How many places should TLS be encrypted/unecrypted for web traffic?

Related, but not the same question as Should SSL be terminated at a load balancer?. Our web stack looks like: Web Server - IIS Load Balancer - NetScalar Firewall - Palo Alto CDN/WAF - Akamai End ...