Skip to main content

ELBs Should Not Have Insecure Ciphers

More Info:​

Insecure ciphers on ELBs should be checked. Various security vulnerabilities have rendered several ciphers insecure. Only the recommended ciphers should be used.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the issue of ELBs having insecure ciphers in AWS, please follow the below steps:

  1. Login to the AWS Management Console.
  2. Go to the EC2 Dashboard.
  3. Select the Load Balancers option from the left-hand menu.
  4. Choose the Load Balancer that you want to remediate.
  5. Click on the Listeners tab.
  6. Select the listener that you want to remediate.
  7. Click on the Edit button.
  8. In the Edit Listener dialog box, click on the Add button to add a new protocol.
  9. Select HTTPS from the Protocol drop-down menu.
  10. Select the SSL certificate from the SSL certificate drop-down menu.
  11. Click on the Add button.
  12. In the SSL Policy drop-down menu, select a secure SSL policy such as ELBSecurityPolicy-2016-08.
  13. Uncheck the insecure ciphers such as RC4 and SSLv3.
  14. Click on the Save button to save the changes.

Once the above steps are completed, the ELB will no longer have insecure ciphers and will be more secure.

Using CLI

To remediate the misconfiguration "ELBs Should Not Have Insecure Ciphers" for AWS using AWS CLI, follow these steps:

  1. Identify the insecure ciphers being used by the ELB. You can use the following command to get a list of ciphers being used by your ELB:
aws elb describe-load-balancers --load-balancer-name <ELB_NAME> --query 'LoadBalancerDescriptions[].ListenerDescriptions[].Listener.Ciphers'
  1. Once you have identified the insecure ciphers, you need to update the security policy of the ELB to disable these ciphers. You can use the following command to update the security policy of the ELB:
aws elb set-load-balancer-policies-for-backend-server --load-balancer-name <ELB_NAME> --policy-names <POLICY_NAME>

Replace <ELB_NAME> with the name of your ELB and <POLICY_NAME> with the name of the security policy that you want to apply. You can find a list of available security policies in the AWS documentation.

  1. After updating the security policy, you should verify that the insecure ciphers have been disabled. You can use the same command as in step 1 to check the ciphers being used by the ELB.

  2. Finally, you should test your ELB to ensure that it is still functioning as expected after disabling the insecure ciphers.

Note: It is recommended to take a backup of the ELB configuration before making any changes.

Using Python

To remediate the issue of ELBs having insecure ciphers in AWS using python, you can follow these steps:

  1. First, you need to identify the ELBs that have insecure ciphers. You can do this by using the AWS CLI command:

    aws elb describe-load-balancers --query "LoadBalancerDescriptions[?ListenerDescriptions[].PolicyNames != '[]'].{LoadBalancerName:LoadBalancerName,PolicyNames:ListenerDescriptions[].PolicyNames}" --output table

    This command will list all the ELBs that have policies attached to their listeners.

  2. Once you have identified the ELBs with insecure ciphers, you can use the AWS CLI command to list the policies attached to each listener:

    aws elb describe-load-balancer-policies --load-balancer-name <ELB_Name> --query "PolicyDescriptions[].{PolicyName:PolicyName,PolicyTypeName:PolicyTypeName,Attributes:PolicyAttributeDescriptions[].{AttributeName:AttributeName,AttributeValue:AttributeValue}}" --output table

    This command will list the policies attached to the specified ELB.

  3. You can then use the AWS CLI command to delete the policies that have insecure ciphers:

    aws elb delete-load-balancer-policy --load-balancer-name <ELB_Name> --policy-name <Policy_Name>

    This command will delete the specified policy from the ELB.

  4. Finally, you can use the AWS CLI command to update the listeners of the ELB to use secure ciphers:

    aws elb create-load-balancer-policy --load-balancer-name <ELB_Name> --policy-name <Policy_Name> --policy-type-name SSLNegotiationPolicyType --policy-attributes AttributeName=Protocol-TLSv1.2,AttributeValue=true AttributeName=CipherOrder,AttributeValue=server-defined

    This command will create a new policy for the ELB that uses secure ciphers.

  5. Repeat steps 2-4 for all the ELBs with insecure ciphers to remediate the issue.

Note: You can also use AWS SDK for Python (Boto3) to perform these actions programmatically.

Using Terraform
# Classic Load Balancer (ELBv1) – attach recommended SSL negotiation policy
resource "aws_elb" "THIS_CLB" {
  name               = "REPLACE_WITH_CLB_NAME"
  subnets            = [REPLACE_WITH_SUBNET_IDS]
  security_groups    = [REPLACE_WITH_SG_IDS]
  cross_zone_load_balancing = true

  listener {
    lb_port           = 443
    lb_protocol       = "HTTPS"
    instance_port     = 80
    instance_protocol = "HTTP"
    ssl_certificate_id = "arn:aws:iam::ACCOUNT_ID:server-certificate/REPLACE_WITH_CERT_NAME"
  }

  # other arguments as needed
}

resource "aws_lb_ssl_negotiation_policy" "clb_https_policy" {
  name          = "REPLACE_WITH_POLICY_NAME" # e.g. "clb-https-fs-1-2-res-2019-08"
  load_balancer = aws_elb.THIS_CLB.id
  lb_port       = 443                         # HTTPS/SSL listener port

  predefined_policy_name = "ELBSecurityPolicy-FS-1-2-Res-2019-08"
}
# Application Load Balancer (ALB) – use recommended SSL policy on HTTPS listener
resource "aws_lb" "THIS_ALB" {
  name               = "REPLACE_WITH_ALB_NAME"
  internal           = false
  load_balancer_type = "application"
  subnets            = [REPLACE_WITH_SUBNET_IDS]
  security_groups    = [REPLACE_WITH_SG_IDS]
}

resource "aws_lb_target_group" "alb_tg" {
  name     = "REPLACE_WITH_TG_NAME"
  port     = 80
  protocol = "HTTP"
  vpc_id   = "REPLACE_WITH_VPC_ID"
}

resource "aws_lb_listener" "alb_https" {
  load_balancer_arn = aws_lb.THIS_ALB.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-FS-1-2-Res-2020-10"

  certificate_arn = "arn:aws:acm:REGION:ACCOUNT_ID:certificate/REPLACE_WITH_CERT_ID"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.alb_tg.arn
  }
}
# Network Load Balancer (NLB) – use recommended SSL policy on TLS listener
resource "aws_lb" "THIS_NLB" {
  name               = "REPLACE_WITH_NLB_NAME"
  internal           = false
  load_balancer_type = "network"
  subnets            = [REPLACE_WITH_SUBNET_IDS]
}

resource "aws_lb_target_group" "nlb_tg" {
  name        = "REPLACE_WITH_TG_NAME"
  port        = 443
  protocol    = "TLS"
  target_type = "ip"
  vpc_id      = "REPLACE_WITH_VPC_ID"
}

resource "aws_lb_listener" "nlb_tls" {
  load_balancer_arn = aws_lb.THIS_NLB.arn
  port              = 443
  protocol          = "TLS"
  ssl_policy        = "ELBSecurityPolicy-FS-1-2-Res-2020-10"

  certificate_arn = "arn:aws:acm:REGION:ACCOUNT_ID:certificate/REPLACE_WITH_CERT_ID"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.nlb_tg.arn
  }
}

Changing the SSL policy/policy attachment will update listeners in place (no load balancer replacement), but it does replace any existing policies on that listener; review before applying.

Verification: terraform plan should show only:

  • predefined_policy_name on each aws_lb_ssl_negotiation_policy changing to ELBSecurityPolicy-FS-1-2-Res-2019-08 for CLBs, and/or
  • ssl_policy on each relevant aws_lb_listener changing to ELBSecurityPolicy-FS-1-2-Res-2020-10 for ALBs/NLBs, with no resource replacements.

Additional Reading:​