The TLS Upgrade
0 likes272 views
The document discusses the migration from TLS 1.0 and 1.1 to TLS 1.2 and 1.3, highlighting the implications of TLS deprecation and providing recommendations for organizations to prepare for the upgrade. It outlines the challenges associated with migrating systems and emphasizes the importance of automating the transition to minimize errors and ensure compliance. Additionally, the document introduces AppViewX Cert+ as a solution for managing the certificate lifecycle and facilitating a smoother upgrade process.
![© 2019 AppViewX, Inc. 3
A Brief History of TLS
TLS 1.2 is Released TLS 1.3 is Released
TLS 1.0 & 1.1 will
be deprecated.
TLS 1.1 is ReleasedTLS 1.0 is Released
Major Browsers
announce early
2020 end-of-
support for TLS
1.0, 1.1
[Apple, Google,
Mozilla,
Microsoft]
(+) Cipher Suite
Specified
Pseudorandom
Functions
(+) AES Cipher Suites
(+) Functional
Enhancements
(-) IDEA Cipher Suites
(-) DES Cipher Suites
Minor Upgrade to
TLS 1.0
(+) Protection
Against Cipher
Block Chaining
(CBC) Attacks
(+) Single Round-
Trip Handshake
(+) Encryption of
SNI Info
(+) RSA-PSS Support
(-) SHA-1
(-) MD5
(-) RC4
(-) DES
(-) 3ES
A replacement
to SSL 3.0
Similar to SSL,
but prevents
interoperability
1999 2006 2008 2018 2020](https://image.slidesharecdn.com/thetlsupgrade-200121125225/85/The-TLS-Upgrade-3-320.jpg)
The TLS Upgrade
- 1. © 2019 AppViewX, Inc. 1 The TLS Upgrade Migrating Away from TLS 1.0 and 1.1
- 2. © 2019 AppViewX, Inc. 2 2 Agenda Implications of the TLS Deprecation The Upgrade: Challenges and Recommendations 2 3 A Brief History of TLS1 How AppViewX Assists the TLS Migration4
- 3. © 2019 AppViewX, Inc. 3 A Brief History of TLS TLS 1.2 is Released TLS 1.3 is Released TLS 1.0 & 1.1 will be deprecated. TLS 1.1 is ReleasedTLS 1.0 is Released Major Browsers announce early 2020 end-of- support for TLS 1.0, 1.1 [Apple, Google, Mozilla, Microsoft] (+) Cipher Suite Specified Pseudorandom Functions (+) AES Cipher Suites (+) Functional Enhancements (-) IDEA Cipher Suites (-) DES Cipher Suites Minor Upgrade to TLS 1.0 (+) Protection Against Cipher Block Chaining (CBC) Attacks (+) Single Round- Trip Handshake (+) Encryption of SNI Info (+) RSA-PSS Support (-) SHA-1 (-) MD5 (-) RC4 (-) DES (-) 3ES A replacement to SSL 3.0 Similar to SSL, but prevents interoperability 1999 2006 2008 2018 2020
- 4. © 2019 AppViewX, Inc. 4 The Immediate Effects of TLS Deprecation Loss of recognition from Big 4 Internet Browsers Once deprecated, clients can no longer connect to services using TLS 1.0 and 1.1. Result: Exposure to vulnerabilities of older versions (Ex: Downgrade Attacks, Failing PCI Compliance Checks) PCI Supports TLS 1.1 and upwards, strongly recommends TLS 1.2
- 5. © 2019 AppViewX, Inc. 5 Preparing for an Upgrade Renew x.509 Certificates Replace/Update Web Servers Ensure Application and API Support of TLS 1.2/1.3 Configure TLS Securely
- 6. © 2019 AppViewX, Inc. 6 TLS 1.2 vs. TLS 1.3 TLS 1.3 is fairly recent, with TLS 1.2 being over a decade old. According to Mozilla, 93% of TLS sessions in 2018 used TLS 1.2, with only 5.6% using TLS 1.3. However, TLS 1.3 boasts of vastly greater performance and experts recommend its use right away. Being a newer protocol, TLS 1.3 has several key advantages over its predecessor. Zero/One Round-Trip Handshakes Removal of SHA-1, DES, AES-CBC etc. No Vulnerability to RC4, BEAST exploits Perfect Forward Secrecy RSA-PSS Standard Implementation Provision to Encrypt SNI Information
- 7. © 2019 AppViewX, Inc. 7 Migrating to TLS 1.2/1.3 : Challenges o The average organization has thousands of applications and systems supporting TLS 1.0 or 1.1. o Each application has one or more devices supporting TLS 1.0 or 1.1. o Manually switching every device to TLS 1.0 is tedious and error- prone. o An automation tool that can efficiently migrate/update the device to TLS 1.2/1.3-compatible ones is a safe, cost-effective method.
- 8. © 2019 AppViewX, Inc. 8 Migrating to TLS 1.2/1.3 : Recommendations Configure end systems to disable TLS 1.0/1.1 Identify technology to replace vulnerable protocols and document secure configurations to be implemented. Identify all system components and data flows that rely on OR support the obsolete protocols. Ensure that servers are TLS 1.2/1.3 cipher compatible. Discover and verify endpoint compatibility with TLS 1.2 and above. Endpoint rectification by enabling TLS 1.2 and above. Block vulnerable ciphers (TLS 1.0, 1.1) on endpoints and plan for a quick rollback if needed.
- 9. © 2019 AppViewX, Inc. 9 How can I prime my PKI to work with an upgraded TLS? Identify Vulnerable Devices Scan your entire network to discover and locate Clients and Servers Migrate Certificate Keys Migrate the hash function from SHA1 to SHA256 to support TLS 1.2 and above Renew Certificates Contact CAs to renew certificates with the SHA256 key type. Push to Endpoints Install the renewed certificates on their respective endpoints.
- 10. © 2019 AppViewX, Inc. 10 End-to-End Automation Platform: AppViewX CERT+ Growing List of Integrations ITSM Web App Firewall Firewall Access Proxy CA DDI SSL Certificates ADC HSM SDN, Branch, NFV
- 11. © 2019 AppViewX, Inc. 11 Accelerated Certificate Renewal and Installation Automated installation on endpoints Achieve an up-to-date certificate infrastructure Scan environments and discover vulnerable devices Set up an automation workflow for bulk renewals Group them according to replacement criteria
- 12. © 2019 AppViewX, Inc. 12 CA-Agnostic Discovery Engine Certificate Discovery Control Panel Inventory Report
- 13. © 2019 AppViewX, Inc. 13 Zero-touch Control over Certificate Infrastructure Holistic View of Certificate Trust Chain
- 14. © 2019 AppViewX, Inc. 14 Process Automation with Visual Workflows Certificate Process Workflow Builder
- 15. © 2019 AppViewX, Inc. 15 Custom Workflow: Auto-Disabling TLS 1.0/1.1 on Endpoints Step 1: Select Endpoint(s)
- 16. © 2019 AppViewX, Inc. 16 Custom Workflow: Auto-Disabling TLS 1.0/1.1 on Endpoints Step 2: Check current version of endpoint(s)
- 17. © 2019 AppViewX, Inc. 17 Custom Workflow: Auto-Disabling TLS 1.0/1.1 on Endpoints Step 3: Disable TLS 1.0/1.1 on endpoint(s)
- 18. © 2019 AppViewX, Inc. 18 Custom Workflow: Auto-Disabling TLS 1.0/1.1 on Endpoints Step 4: Implementation of TLS 1.0/1.1 disablement
- 19. © 2019 AppViewX, Inc. 19 Custom Workflow: Auto-Disabling TLS 1.0/1.1 on Endpoints Step 5: Check TLS version post disablement of vulnerable version
- 20. © 2019 AppViewX, Inc. 20 Value Proposition of Certificate Lifecycle Automation ELIMINATE ERRORS Remove manual steps in development and production ENFORCE COMPLIANCE Deliver and protect applications as you intend MOVE FASTER Automate network infrastructure services REDUCE COST Take out complexity and do more with less
- 21. © 2019 AppViewX, Inc. 21 Real-world Business Benefits of AppViewX Reduction in Issuance Time Reduction in Deployment Time Reduction in Configuration Time 70% 83% 70% 0% Configuration Errors 0% Outages
- 22. © 2019 AppViewX, Inc. 22 Schedule a Live Demo