CRY-05—Encryption of Data in Transit

1. Inspect Organization's Data Classification and Handling Standard and Data Encryption Standard to determine whether requirements for encrypting data at rest were defined. 2. Obtain the list of all public facing endpoints for the service. Inspect each public facing endpoint to determine if data sent in transit is encrypted by performing the following: a. Inspecting the TLS version and cipher suites being used over browser. b. Inspecting the validity of the digital certificates being used by the endpoint. c. Running a Qualys provided SSL labs feature that scans and endpoint and enumerates all ciphers and TLS versions permitted on an end point 3. If the service does not have public facing endpoints, obtain configuration of the load balancer and corresponding Security group with details of TLS versions allows and cipher suites allowed. 4. Obtain the list of expired SSL certificates and validate whether. tracking and remediation of the expired SSL were performed.