Create an outbound SSL Policy

VisokaNivo 1Ručni pregledcisco-ftd

Opis

As time moves forward, we see more and more traffic that was previously in clear text now being implemented with encryption. This makes inspecting that traffic for malicious activity more and more complex. Decrypting traffic for inspection makes that process much easier, however, privacy and legal factors should be considered before implementing such as process. Decryption is governed by the "SSL Policy". Standard HTTPS traffic is a good target for decryption, as configuring Firepower to decrypt, inspect then re-encrypt traffic is fairly straightforward. In most cases, the following site categories should not be decrypted: - Finance - Government and Law - ... CIS assessment: Manual. Reported as SKIP with review instructions.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

CIS assessment: Manual. - Verify that you have a written policy that permits decryption that has been communicated to the people that are affected by that policy. - Navigate to Policies > SSL - Verify that, at a minimum the site categories: "Finance", "Government and Law", "Health and Medicine" have a "Do not decrypt" action assigned to them - Assess other "Decrypt - Resign" and "Do not Decrypt" assignments for compliance to your policy - Verify that any sites assigned a "Do not decrypt" action for performance or operational reasons (such as pinned ...

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

! - Verify that you have a written policy that permits decryption that has been communicated to the people that are affected by that policy. - Navigate to Policies > SSL - Create rules to define what is exempted from decryption. At a minimum the site categories: "Finance", "Government and Law", "Health and Medicine" should have a "do not decrypt" action assigned to them - Assess other "Decrypt - Resign" and "Do not Decrypt" assignments for compliance to your policy - Verify that any sites assigned a "Do not decrypt" action for performance or operational reasons still fall within the parameters of your policy - In most rulesets, there will be a "default" rule at the bottom of the list, which will either decrypt all other sites, or exempt all other sites from decryption. - Verify that your SSL Policy is assigned in the Access Policy (Policies > Access Control > <Your Access Policy> > SSL Policy)

Svojstva

Operativni sistemi: Bilo koji
Oznake: cisco-ftdnetworkhardening
Referenca: CIS Cisco Firepower Threat Defense Benchmark v1.0.0 - 2.1.2 Create an outbound SSL Policy