SC-8Transmission Confidentiality and Integrity

Implementations targeting this control (10)

• aws-config-elb-tls-https-listeners-only ELB / ALB listeners use HTTPS or TLS AWS::ElasticLoadBalancingV2::Listener partial protect enforce
• aws-config-alb-http-to-https-redirection-check Alb Http To Https Redirection Check AWS::ElasticLoadBalancingV2::LoadBalancer partial protect enforce
• aws-config-api-gw-ssl-enabled Api Gw Ssl Enabled AWS::ApiGateway::Stage partial protect enforce
• aws-config-elasticsearch-node-to-node-encryption-check Elasticsearch Node To Node Encryption Check AWS::OpenSearchService::Domain partial protect enforce
• aws-config-elb-acm-certificate-required Elb Acm Certificate Required AWS::ElasticLoadBalancing::LoadBalancer partial protect enforce
• aws-config-elbv2-acm-certificate-required Elbv2 Acm Certificate Required AWS::ElasticLoadBalancingV2::LoadBalancer partial protect enforce
• aws-config-opensearch-https-required Opensearch Https Required AWS::OpenSearchService::Domain partial protect enforce
• aws-config-opensearch-node-to-node-encryption-check Opensearch Node To Node Encryption Check AWS::OpenSearchService::Domain partial protect enforce
• aws-config-redshift-require-tls-ssl Redshift Require Tls Ssl AWS::Redshift::Cluster partial protect enforce
• aws-config-s3-bucket-ssl-requests-only S3 Bucket Ssl Requests Only AWS::S3::Bucket partial protect enforce CIS §2.1.1Hub S3.5

ATT&CK techniques this control mitigates (19)

• T1020.001 Traffic Duplication Exfiltration
• T1040 Network Sniffing Credential Access, Discovery
• T1090 Proxy Command And Control
• T1090.004 Domain Fronting Command And Control
• T1550.001 Application Access Token Lateral Movement
• T1550.004 Web Session Cookie Lateral Movement
• T1552.007 Container API Credential Access
• T1557 Adversary-in-the-Middle Credential Access, Collection
• T1557.001 Name Resolution Poisoning and SMB Relay Credential Access, Collection
• T1557.002 ARP Cache Poisoning Credential Access, Collection
• T1557.003 DHCP Spoofing Credential Access, Collection
• T1557.004 Evil Twin Credential Access, Collection
• T1602 Data from Configuration Repository Collection
• T1602.001 SNMP (MIB Dump) Collection
• T1602.002 Network Device Configuration Dump Collection
• T1622 Debugger Evasion Stealth, Discovery
• T1685 Disable or Modify Tools Defense Impairment
• T1688 Safe Mode Boot Defense Impairment
• T1689 Downgrade Attack Defense Impairment

Weaknesses this control addresses (5)AI-assisted

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

Top CVEs where this control is the strongest mitigation

Other controls in family SC