Cybersecurity/Goverment: Difference between revisions

From Cramsession
Jump to navigationJump to search
✍️ Verified Author: Mflavell • Click to view professional profile & credentials
VisualWikitext
(Created page with "This is the one page "cheat sheet" for goverment regulation in the US and how it relates to cybersecurity. = SSP = SSP - System Security plan Think of this as the master bluprint for the system. * It's a living document * Describes autntoszation boundaires / data flows / protocols ect The SSP requires: * WHAT: A clear definition of what is protected * HOW: How it is protected and isolated Without a What and How it is not protected!!! How it relates to NIST 800-...")
 
No edit summary
Line 40: Line 40:
*** TLS 1.0 and 1.1 Should not be used
*** TLS 1.0 and 1.1 Should not be used


=== More about TLS ===
[[Cybersecurity/Goverment/TLS_and_cyphers|🤔More about TLS]]
 
Enabling TLS 1.3 is not enough - the underlying software / hardware must be approved.
 
The cypher suite must also be enforced.
 
{| class="wikitable sortable"
! Protocol Version
! NIST Priority
! Standard RFC Cipher Name
! Key Exchange / Encryption Details
|-
| '''TLS 1.3'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_AES_128_GCM_SHA256
| AEAD / 128-bit AES-GCM (Mandatory baseline)
|-
| '''TLS 1.3'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_AES_256_GCM_SHA384
| AEAD / 256-bit AES-GCM (Mandatory baseline)
|-
| '''TLS 1.3'''
| style="background:#fff3cd;" | ✅ '''Acceptable'''
| TLS_AES_128_CCM_SHA256
| AEAD / 128-bit AES-CCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
| ECDH Exchange + ECDSA Auth + 128-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
| ECDH Exchange + ECDSA Auth + 256-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
| ECDH Exchange + RSA Auth + 128-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
| ECDH Exchange + RSA Auth + 256-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
| ECDH Exchange + ECDSA Auth + 128-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
| ECDH Exchange + ECDSA Auth + 256-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
| ECDH Exchange + RSA Auth + 128-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
| ECDH Exchange + RSA Auth + 256-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
| Finite Field DH + RSA Auth + 128-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
| Finite Field DH + RSA Auth + 256-bit AES-GCM
|}
 




Revision as of 16:09, 22 October 2026

This is the one page "cheat sheet" for goverment regulation in the US and how it relates to cybersecurity.

SSP

SSP - System Security plan

Think of this as the master bluprint for the system.

  • It's a living document
  • Describes autntoszation boundaires / data flows / protocols ect


The SSP requires:

  • WHAT: A clear definition of what is protected
  • HOW: How it is protected and isolated

Without a What and How it is not protected!!!


How it relates to NIST 800-53:

  • Describes how every 800-53 control is technically implemented.


How SSP relates to AWS Gov Cloud

Multi account governance:

  • Don't trust other accounts
  • Use AWS control tower to implement service control policies / lock down account boundaries.

Data protection:

  • Data at rest and in transit
    • S3 Bucket polcies and encryption
    • TLS Enforcement
      • TLS 1.3 is a mandotary baseline
      • TLS 1.2 can be used with approval
      • TLS 1.0 and 1.1 Should not be used

🤔More about TLS



DoD IL4/IL5

FedRAMP High

NIST 800-53 Rev 5

GovRAMP/StateRAMP

3PAO

Retrieved from "https://cramsession.net/index.php?title=Cybersecurity/Goverment&oldid=1908"