asvs/v12-secure-communication

13 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

V12.2.1 TLS for client-service connectivity requirement

Requirement V12.2.1 applies to Level 1. It requires verifying that TLS is used for all connectivity between a client and external facing, HTTP-based services, and does not fall back to insecure or unencrypted communications.

V12.2.2 Publicly trusted TLS certificates requirement

Requirement V12.2.2 applies to Level 1. It requires verifying that external facing services use publicly trusted TLS certificates.

V12.1.1 TLS protocol versions requirement

Requirement V12.1.1 applies to Level 1. It requires verifying that only the latest recommended versions of the TLS protocol are enabled, such as TLS 1.2 and TLS 1.3, with the latest version of the TLS protocol being the preferred option.

V12.1.2 Cipher suites requirement

Requirement V12.1.2 applies to Level 2. It requires verifying that only recommended cipher suites are enabled, with the strongest cipher suites set as preferred. Level 3 applications must only support cipher suites which provide forward secrecy.

V12.1.3 mTLS client certificate validation requirement

Requirement V12.1.3 applies to Level 2. It requires verifying that the application validates that mTLS client certificates are trusted before using the certificate identity for authentication or authorization.

V12.1.4 Certificate revocation requirement

Requirement V12.1.4 applies to Level 3. It requires verifying that proper certification revocation, such as Online Certificate Status Protocol (OCSP) Stapling, is enabled and configured.

V12.1.5 Encrypted Client Hello requirement

Requirement V12.1.5 applies to Level 3. It requires verifying that Encrypted Client Hello (ECH) is enabled in the application's TLS settings to prevent exposure of sensitive metadata, such as the Server Name Indication (SNI), during TLS handshake processes.

V12.3.1 Encrypted protocol for all connections requirement

Requirement V12.3.1 applies to Level 2. It requires verifying that an encrypted protocol such as TLS is used for all inbound and outbound connections to and from the application, including monitoring systems, management tools, remote access and SSH, middleware, databases, mainframes, partner systems, or external APIs, and that the server must not fall back to insecure or unencrypted protocols.

V12.3.2 TLS client certificate validation requirement

Requirement V12.3.2 applies to Level 2. It requires verifying that TLS clients validate certificates received before communicating with a TLS server.

V12.3.3 TLS for internal HTTP-based services requirement

Requirement V12.3.3 applies to Level 2. It requires verifying that TLS or another appropriate transport encryption mechanism is used for all connectivity between internal, HTTP-based services within the application, and does not fall back to insecure or unencrypted communications.

V12.3.4 Trusted certificates for internal TLS connections requirement

Requirement V12.3.4 applies to Level 2. It requires verifying that TLS connections between internal services use trusted certificates. Where internally generated or self-signed certificates are used, the consuming service must be configured to only trust specific internal CAs and specific self-signed certificates.

V12.3.5 Strong authentication for intra-service communications requirement

Requirement V12.3.5 applies to Level 3. It requires verifying that services communicating internally within a system (intra-service communications) use strong authentication to ensure that each endpoint is verified. Strong authentication methods, such as TLS client authentication, must be employed to ensure identity, using public-key infrastructure and mechanisms that are resistant to replay attacks. For microservice architectures, consider using a service mesh to simplify certificate management and enhance security.

V12 chapter control objective

The V12 Secure Communication chapter includes requirements related to mechanisms that should be in place to protect data in transit, both between an end-user client and a backend service, as well as between internal and backend services. Key concepts include ensuring communications are encrypted externally and ideally internally, configuring encryption mechanisms using latest guidance, and using signed certificates to prevent unauthorized interception.

Give your agent this brain