Cybersecurity/Goverment
From Cramsession
Jump to navigationJump to search
✍️ Verified Author: Mflavell • Click to view professional profile & credentials
This is the one page "cheat sheet" for goverment regulation in the US and how it relates to cybersecurity.
SSP
SSP - System Security plan
Think of this as the master bluprint for the system.
- It's a living document
- Describes autntoszation boundaires / data flows / protocols ect
The SSP requires:
- WHAT: A clear definition of what is protected
- HOW: How it is protected and isolated
Without a What and How it is not protected!!!
How it relates to NIST 800-53:
- Describes how every 800-53 control is technically implemented.
How SSP relates to AWS Gov Cloud
Multi account governance:
- Don't trust other accounts
- Use AWS control tower to implement service control policies / lock down account boundaries.
Data protection:
- Data at rest and in transit
- S3 Bucket polcies and encryption
- TLS Enforcement
- TLS 1.3 is a mandotary baseline
- TLS 1.2 can be used with approval
- TLS 1.0 and 1.1 Should not be used
More about TLS
Enabling TLS 1.3 is not enough - the underlying software / hardware must be approved.
The cypher suite must also be enforced.
| Protocol Version | NIST Priority | Standard RFC Cipher Name | Key Exchange / Encryption Details |
|---|---|---|---|
| TLS 1.3 | 🌟 Preferred | TLS_AES_128_GCM_SHA256 | AEAD / 128-bit AES-GCM (Mandatory baseline) |
| TLS 1.3 | 🌟 Preferred | TLS_AES_256_GCM_SHA384 | AEAD / 256-bit AES-GCM (Mandatory baseline) |
| TLS 1.3 | ✅ Acceptable | TLS_AES_128_CCM_SHA256 | AEAD / 128-bit AES-CCM |
| TLS 1.2 | 🌟 Preferred | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 | ECDH Exchange + ECDSA Auth + 128-bit AES-GCM |
| TLS 1.2 | 🌟 Preferred | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | ECDH Exchange + ECDSA Auth + 256-bit AES-GCM |
| TLS 1.2 | 🌟 Preferred | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | ECDH Exchange + RSA Auth + 128-bit AES-GCM |
| TLS 1.2 | 🌟 Preferred | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | ECDH Exchange + RSA Auth + 256-bit AES-GCM |
| TLS 1.2 | ⚠️ Legacy Fallback | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 | ECDH Exchange + ECDSA Auth + 128-bit AES-CBC |
| TLS 1.2 | ⚠️ Legacy Fallback | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 | ECDH Exchange + ECDSA Auth + 256-bit AES-CBC |
| TLS 1.2 | ⚠️ Legacy Fallback | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | ECDH Exchange + RSA Auth + 128-bit AES-CBC |
| TLS 1.2 | ⚠️ Legacy Fallback | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | ECDH Exchange + RSA Auth + 256-bit AES-CBC |
| TLS 1.2 | ⚠️ Legacy Fallback | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | Finite Field DH + RSA Auth + 128-bit AES-GCM |
| TLS 1.2 | ⚠️ Legacy Fallback | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | Finite Field DH + RSA Auth + 256-bit AES-GCM |
