SC-23Session Authenticity

Implementations targeting this control (10)

• aws-config-elb-tls-https-listeners-only ELB / ALB listeners use HTTPS or TLS AWS::ElasticLoadBalancingV2::Listener partial protect enforce
• aws-config-alb-http-to-https-redirection-check Alb Http To Https Redirection Check AWS::ElasticLoadBalancingV2::LoadBalancer partial protect enforce
• aws-config-api-gw-ssl-enabled Api Gw Ssl Enabled AWS::ApiGateway::Stage partial protect enforce
• aws-config-elasticsearch-node-to-node-encryption-check Elasticsearch Node To Node Encryption Check AWS::OpenSearchService::Domain partial protect enforce
• aws-config-elb-acm-certificate-required Elb Acm Certificate Required AWS::ElasticLoadBalancing::LoadBalancer partial protect enforce
• aws-config-elbv2-acm-certificate-required Elbv2 Acm Certificate Required AWS::ElasticLoadBalancingV2::LoadBalancer partial protect enforce
• aws-config-opensearch-https-required Opensearch Https Required AWS::OpenSearchService::Domain partial protect enforce
• aws-config-opensearch-node-to-node-encryption-check Opensearch Node To Node Encryption Check AWS::OpenSearchService::Domain partial protect enforce
• aws-config-redshift-require-tls-ssl Redshift Require Tls Ssl AWS::Redshift::Cluster partial protect enforce
• aws-config-s3-bucket-ssl-requests-only S3 Bucket Ssl Requests Only AWS::S3::Bucket partial protect enforce CIS §2.1.1Hub S3.5

ATT&CK techniques this control mitigates (20)

• T1071 Application Layer Protocol Command And Control
• T1071.001 Web Protocols Command And Control
• T1071.002 File Transfer Protocols Command And Control
• T1071.003 Mail Protocols Command And Control
• T1071.004 DNS Command And Control
• T1185 Browser Session Hijacking Collection
• T1535 Unused/Unsupported Cloud Regions Stealth
• T1550.004 Web Session Cookie Lateral Movement
• T1557 Adversary-in-the-Middle Credential Access, Collection
• T1557.001 Name Resolution Poisoning and SMB Relay Credential Access, Collection
• T1557.002 ARP Cache Poisoning Credential Access, Collection
• T1557.003 DHCP Spoofing Credential Access, Collection
• T1557.004 Evil Twin Credential Access, Collection
• T1563.001 SSH Hijacking Lateral Movement
• T1573 Encrypted Channel Command And Control
• T1573.001 Symmetric Cryptography Command And Control
• T1573.002 Asymmetric Cryptography Command And Control
• T1622 Debugger Evasion Stealth, Discovery
• T1685 Disable or Modify Tools Defense Impairment
• T1688 Safe Mode Boot Defense Impairment

Weaknesses this control addresses (8)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

Top CVEs where this control is the strongest mitigation

Other controls in family SC