Cramsession - Recent changes [en]

Cybersecurity/Goverment

Mflavell — Sat, 24 Oct 2026 02:05:55 GMT

Cybersecurity/Goverment/TLS and cyphers

Mflavell — Thu, 22 Oct 2026 16:27:50 GMT

What about SSL?

← Older revision		Revision as of 16:27, 22 October 2026
(7 intermediate revisions by the same user not shown)
Line 94:		Line 94:
	** An attacker could modifiy the handshake and downgrade the connection.		** An attacker could modifiy the handshake and downgrade the connection.
	** Injection of data into the TLS session.		** Injection of data into the TLS session.


	== What about SSL? ==		== What about SSL? ==
Line 100:		Line 99:
	TLS (Transport Layer Security) is the direct replacement for SSL:		TLS (Transport Layer Security) is the direct replacement for SSL:

	[Netscape] [IETF Standard]		[Netscape] [IETF Standard]
	SSL 1.0 ──> SSL 2.0 ──> SSL 3.0 ──> TLS 1.0 ──> TLS 1.1 ──> TLS 1.2 ──> TLS 1.3		SSL 1.0 ──> SSL 2.0 ──> SSL 3.0 ──> TLS 1.0 ──> TLS 1.1 ──> TLS 1.2 ──> TLS 1.3
	(1994) (1995) (1996) (1999) (2006) (2008) (2018)		(1994) (1995) (1996) (1999) (2006) (2008) (2018)
	─────── PROHIBITED ─────────── ──── DEPRECATED ──── ─── VALID/APPROVED ───		─────── PROHIBITED ─────────── ──── DEPRECATED ──── ─── VALID/APPROVED ───

			🤬 Many people even developers talk about SSL - SSL is a fossil 🦖- They are realy talking about TLS but SSL is burned into the cluture very deep - for example "SSL Certificates" that are really "x.509 Cetfificates"

Cybersecurity/Goverment/TLS and cyphers

Mflavell — Thu, 22 Oct 2026 16:20:42 GMT

Created page with " == TLS Versions == * TLS <1.2 - Should never be used * TLS 1.2 - Used under some circumstances * TLS 1.3 - Preferred == Valid Cypher Suites == The TLS version alone is not enough, the underlying hardware, software and cypher suites must be considered. {| class="wikitable sortable" ! Protocol Version ! NIST Priority ! Standard RFC Cipher Name ! Key Exchange / Encryption Details |- | '''TLS 1.3''' | style="background:#d4edda;" | 🌟 '''Preferred''' | TLS_AES_128_GC..."

New page

== TLS Versions ==

* TLS <1.2 - Should never be used
* TLS 1.2 - Used under some circumstances
* TLS 1.3 - Preferred

== Valid Cypher Suites ==

The TLS version alone is not enough, the underlying hardware, software and cypher suites must be considered.

{| class="wikitable sortable"
! Protocol Version
! NIST Priority
! Standard RFC Cipher Name
! Key Exchange / Encryption Details
|-
| '''TLS 1.3'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_AES_128_GCM_SHA256
| AEAD / 128-bit AES-GCM (Mandatory baseline)
|-
| '''TLS 1.3'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_AES_256_GCM_SHA384
| AEAD / 256-bit AES-GCM (Mandatory baseline)
|-
| '''TLS 1.3'''
| style="background:#fff3cd;" | ✅ '''Acceptable'''
| TLS_AES_128_CCM_SHA256
| AEAD / 128-bit AES-CCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
| ECDH Exchange + ECDSA Auth + 128-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
| ECDH Exchange + ECDSA Auth + 256-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
| ECDH Exchange + RSA Auth + 128-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
| ECDH Exchange + RSA Auth + 256-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
| ECDH Exchange + ECDSA Auth + 128-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
| ECDH Exchange + ECDSA Auth + 256-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
| ECDH Exchange + RSA Auth + 128-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
| ECDH Exchange + RSA Auth + 256-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
| Finite Field DH + RSA Auth + 128-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
| Finite Field DH + RSA Auth + 256-bit AES-GCM
|}

== Why not TLS 1.1 ==

The core problem with TLS 1.1 even with a valid cypher suite is man-in-the-middle attacks.

The cypher suite only protects data after a secure connection is established. The key problem been how TLS 1.1 manages the connection.

** An attacker could modifiy the handshake and downgrade the connection.
** Injection of data into the TLS session.

== What about SSL? ==

TLS (Transport Layer Security) is the direct replacement for SSL:

[Netscape] [IETF Standard]
SSL 1.0 ──> SSL 2.0 ──> SSL 3.0 ──> TLS 1.0 ──> TLS 1.1 ──> TLS 1.2 ──> TLS 1.3
(1994) (1995) (1996) (1999) (2006) (2008) (2018)
─────── PROHIBITED ─────────── ──── DEPRECATED ──── ─── VALID/APPROVED ───

Cybersecurity/Goverment

Mflavell — Thu, 22 Oct 2026 16:09:17 GMT

← Older revision		Revision as of 16:09, 22 October 2026
Line 40:		Line 40:
	*** TLS 1.0 and 1.1 Should not be used		*** TLS 1.0 and 1.1 Should not be used

	~~=== More about TLS ===~~		[[Cybersecurity/Goverment/TLS_and_cyphers\|🤔More about TLS]]

	~~Enabling TLS 1.3 is not enough - the underlying software~~ / ~~hardware must be approved.~~

	~~The cypher suite must also be enforced.~~

	~~{\| class="wikitable sortable"~~
	~~! Protocol Version~~
	~~! NIST Priority~~
	~~! Standard RFC Cipher Name~~
	~~! Key Exchange~~ / ~~Encryption Details~~
	\|-
	~~\| '''TLS 1.3'''~~
	~~\| style="background:#d4edda;" \| 🌟 '''Preferred'''~~
	~~\| TLS_AES_128_GCM_SHA256~~
	~~\| AEAD / 128-bit AES-GCM (Mandatory baseline)~~
	\|-
	~~\| '''TLS 1.3'''~~
	~~\| style="background:#d4edda;" \| 🌟 '''Preferred'''~~
	~~\| TLS_AES_256_GCM_SHA384~~
	~~\| AEAD / 256-bit AES-GCM (Mandatory baseline)~~
	\|-
	~~\| '''TLS 1.3'''~~
	~~\| style="background:#fff3cd;" \| ✅ '''Acceptable'''~~
	~~\| TLS_AES_128_CCM_SHA256~~
	~~\| AEAD / 128-bit AES-CCM~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#d4edda;" \| 🌟 '''Preferred'''~~
	~~\| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256~~
	~~\| ECDH Exchange + ECDSA Auth + 128-bit AES-GCM~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#d4edda;" \| 🌟 '''Preferred'''~~
	~~\| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384~~
	~~\| ECDH Exchange + ECDSA Auth + 256-bit AES-GCM~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#d4edda;" \| 🌟 '''Preferred'''~~
	~~\| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256~~
	~~\| ECDH Exchange + RSA Auth + 128-bit AES-GCM~~
	\|-
	~~\| '''~~TLS ~~1.2'''~~
	~~\| style="background:#d4edda;" \| 🌟 '''Preferred'''~~
	~~\| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384~~
	~~\| ECDH Exchange + RSA Auth + 256-bit AES-GCM~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#f8d7da;" \| ⚠️ ''Legacy Fallback''~~
	~~\| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256~~
	~~\| ECDH Exchange + ECDSA Auth + 128-bit AES-CBC~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#f8d7da;" \| ⚠️ ''Legacy Fallback''~~
	~~\| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384~~
	~~\| ECDH Exchange + ECDSA Auth + 256-bit AES-CBC~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#f8d7da;" \| ⚠️ ''Legacy Fallback''~~
	~~\| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256~~
	~~\| ECDH Exchange + RSA Auth + 128-bit AES-CBC~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#f8d7da;" \| ⚠️ ''Legacy Fallback''~~
	~~\| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384~~
	~~\| ECDH Exchange + RSA Auth + 256-bit AES-CBC~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#f8d7da;" \| ⚠️ ''Legacy Fallback''~~
	~~\| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256~~
	~~\| Finite Field DH + RSA Auth + 128-bit AES-GCM~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#f8d7da;" \| ⚠️ ''Legacy Fallback''~~
	~~\| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384~~
	~~\| Finite Field DH + RSA Auth + 256-bit AES-GCM~~
	\|}

Cybersecurity/Goverment

Mflavell — Thu, 22 Oct 2026 16:06:25 GMT

Created page with "This is the one page "cheat sheet" for goverment regulation in the US and how it relates to cybersecurity. = SSP = SSP - System Security plan Think of this as the master bluprint for the system. * It's a living document * Describes autntoszation boundaires / data flows / protocols ect The SSP requires: * WHAT: A clear definition of what is protected * HOW: How it is protected and isolated Without a What and How it is not protected!!! How it relates to NIST 800-..."

New page

This is the one page "cheat sheet" for goverment regulation in the US and how it relates to cybersecurity.

= SSP =

SSP - System Security plan

Think of this as the master bluprint for the system.

* It's a living document
* Describes autntoszation boundaires / data flows / protocols ect

The SSP requires:

* WHAT: A clear definition of what is protected
* HOW: How it is protected and isolated

Without a What and How it is not protected!!!

How it relates to NIST 800-53:

* Describes how every 800-53 control is technically implemented.

== How SSP relates to AWS Gov Cloud ==

Multi account governance:

* Don't trust other accounts
* Use AWS control tower to implement service control policies / lock down account boundaries.

Data protection:

* Data at rest and in transit
** S3 Bucket polcies and encryption
** TLS Enforcement
*** TLS 1.3 is a mandotary baseline
*** TLS 1.2 can be used with approval
*** TLS 1.0 and 1.1 Should not be used

=== More about TLS ===

Enabling TLS 1.3 is not enough - the underlying software / hardware must be approved.

The cypher suite must also be enforced.

{| class="wikitable sortable"
! Protocol Version
! NIST Priority
! Standard RFC Cipher Name
! Key Exchange / Encryption Details
|-
| '''TLS 1.3'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_AES_128_GCM_SHA256
| AEAD / 128-bit AES-GCM (Mandatory baseline)
|-
| '''TLS 1.3'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_AES_256_GCM_SHA384
| AEAD / 256-bit AES-GCM (Mandatory baseline)
|-
| '''TLS 1.3'''
| style="background:#fff3cd;" | ✅ '''Acceptable'''
| TLS_AES_128_CCM_SHA256
| AEAD / 128-bit AES-CCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
| ECDH Exchange + ECDSA Auth + 128-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
| ECDH Exchange + ECDSA Auth + 256-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
| ECDH Exchange + RSA Auth + 128-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
| ECDH Exchange + RSA Auth + 256-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
| ECDH Exchange + ECDSA Auth + 128-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
| ECDH Exchange + ECDSA Auth + 256-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
| ECDH Exchange + RSA Auth + 128-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
| ECDH Exchange + RSA Auth + 256-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
| Finite Field DH + RSA Auth + 128-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
| Finite Field DH + RSA Auth + 256-bit AES-GCM
|}

= DoD IL4/IL5 =
= FedRAMP High =
= NIST 800-53 Rev 5 =
= GovRAMP/StateRAMP =
= 3PAO =

Cybersecurity

Mflavell — Thu, 22 Oct 2026 15:35:40 GMT

← Older revision		Revision as of 15:35, 22 October 2026
Line 2:		Line 2:

	[https://www.cvedetails.com 🔍CVE Search]		[https://www.cvedetails.com 🔍CVE Search]

			[[Cybersecurity/Goverment\|🏢Government]]

	[[Vulnerability tree \|🌴Vulnerability tree]]		[[Vulnerability tree \|🌴Vulnerability tree]]

Study Guides/AWS Cybersecurity Notes/Security Hub & Guard Duty

Mflavell — Wed, 21 Oct 2026 22:28:56 GMT

Insights in Security hub

Show changes

← Older revision		Revision as of 16:09, 22 October 2026
Line 40:		Line 40:
	*** TLS 1.0 and 1.1 Should not be used		*** TLS 1.0 and 1.1 Should not be used

	~~=== More about TLS ===~~		[[Cybersecurity/Goverment/TLS_and_cyphers\|🤔More about TLS]]

	~~Enabling TLS 1.3 is not enough - the underlying software~~ / ~~hardware must be approved.~~

	~~The cypher suite must also be enforced.~~

	~~{\| class="wikitable sortable"~~
	~~! Protocol Version~~
	~~! NIST Priority~~
	~~! Standard RFC Cipher Name~~
	~~! Key Exchange~~ / ~~Encryption Details~~
	\|-
	~~\| '''TLS 1.3'''~~
	~~\| style="background:#d4edda;" \| 🌟 '''Preferred'''~~
	~~\| TLS_AES_128_GCM_SHA256~~
	~~\| AEAD / 128-bit AES-GCM (Mandatory baseline)~~
	\|-
	~~\| '''TLS 1.3'''~~
	~~\| style="background:#d4edda;" \| 🌟 '''Preferred'''~~
	~~\| TLS_AES_256_GCM_SHA384~~
	~~\| AEAD / 256-bit AES-GCM (Mandatory baseline)~~
	\|-
	~~\| '''TLS 1.3'''~~
	~~\| style="background:#fff3cd;" \| ✅ '''Acceptable'''~~
	~~\| TLS_AES_128_CCM_SHA256~~
	~~\| AEAD / 128-bit AES-CCM~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#d4edda;" \| 🌟 '''Preferred'''~~
	~~\| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256~~
	~~\| ECDH Exchange + ECDSA Auth + 128-bit AES-GCM~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#d4edda;" \| 🌟 '''Preferred'''~~
	~~\| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384~~
	~~\| ECDH Exchange + ECDSA Auth + 256-bit AES-GCM~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#d4edda;" \| 🌟 '''Preferred'''~~
	~~\| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256~~
	~~\| ECDH Exchange + RSA Auth + 128-bit AES-GCM~~
	\|-
	~~\| '''~~TLS ~~1.2'''~~
	~~\| style="background:#d4edda;" \| 🌟 '''Preferred'''~~
	~~\| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384~~
	~~\| ECDH Exchange + RSA Auth + 256-bit AES-GCM~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#f8d7da;" \| ⚠️ ''Legacy Fallback''~~
	~~\| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256~~
	~~\| ECDH Exchange + ECDSA Auth + 128-bit AES-CBC~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#f8d7da;" \| ⚠️ ''Legacy Fallback''~~
	~~\| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384~~
	~~\| ECDH Exchange + ECDSA Auth + 256-bit AES-CBC~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#f8d7da;" \| ⚠️ ''Legacy Fallback''~~
	~~\| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256~~
	~~\| ECDH Exchange + RSA Auth + 128-bit AES-CBC~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#f8d7da;" \| ⚠️ ''Legacy Fallback''~~
	~~\| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384~~
	~~\| ECDH Exchange + RSA Auth + 256-bit AES-CBC~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#f8d7da;" \| ⚠️ ''Legacy Fallback''~~
	~~\| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256~~
	~~\| Finite Field DH + RSA Auth + 128-bit AES-GCM~~
	\|-
	~~\| '''TLS 1.2'''~~
	~~\| style="background:#f8d7da;" \| ⚠️ ''Legacy Fallback''~~
	~~\| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384~~
	~~\| Finite Field DH + RSA Auth + 256-bit AES-GCM~~
	\|}