TMA-IBMCLOUD-6.1.1
Enable TLS 1.2 at minimum for all inbound traffic on IBM Cloud Internet Services Proxy
Description
The Transport Layer Security (TLS) options let you control whether visitors can browse your website over a secure connection, and when they do, how IBM Cloud™ Internet Services connects to your origin server. Ensure minimum TLS level for TLS termination is set to TLS 1.2. Use the latest version of the TLS protocol (TLS 1.3) for improved security and performance by switching from Disabled to Enabled or Enabled+ORTT in the list. TLS encryption modes Set the TLS mode by selecting one of the following options from the Mode list. These options are listed in the order from the least secure (Off) to the most secure (End-to-End CA signed). - Off (not recommended) - Client-to-Edge (edge to origin not encrypted, self-signed certificates are not supported) - End-to-End flexible (edge to origin certificates can be self-signed) - End-to-End CA signed (default and recommended) - HTTPS only origin p...
Méthode de vérification
Méthode d'audit: Revue manuelle
Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.
The Minimum TLS setting can be audited using the following mechanisms IBM Cloud Console 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. Click Menu icon --> Resource list 3. Select the Cloud Internet Service Instance 4. Select the domain that needs to be audited from the domains drop down 5. Choose the Security section from the left panel. 6. Click on the TLS tab in the Security panel. 7. Verify the Traffic Encryption - Minimum TLS Version is set to a value of TLS 1.2(default) or higher IBM Cloud CLI 1. Verify min_tls_version must be set to 1.2 or higher ibmcloud cis tls-settings e476aba943b5d7d29b96135c78aa55c9 --output json { "min_tls_version": "1.2", "ssl": "strict", "tls_1_2_only": "off", "tls_1_3": "off", "universal": true }
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
IBM Cloud Console 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. Click Menu icon -- Resource list 3. Select the Cloud Internet Service Instance that needs to be remediated from the domains drop down. 4. Choose the Security section from the left panel. 5. Click on the TLS tab in the Security panel. 6. Change the TLS version on Traffic Encryption - Minimum TLS Version to TLS 1.2(default) IBM Cloud CLI 1. Set min_tls_version to 1.2 ibmcloud cis tls-settings-update <DOMAIN_ID> -i <Instance-Name> --min- tls-version 1.2
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- cloudibmcloudtls
- Référence
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 6.1.1 Enable TLS 1.2 at minimum for all inbound traffic on IBM Cloud Internet Services Proxy