Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 13 replies
  • Answers 1 answer
  • Subscribers 31 subscribers
  • Views 33462 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Failing PCI Scans - How do I disable TLS 1.0 and block DES & 3DES?

AllanD

On our XG running 16.01.02 firmware we are failing our PCI compliance scans due to both TLS 1.0 being enabled and cipher vulnerability called Sweet32 (https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2183).  On my old TMG I could go into the register and disable the "Triple DES 168" cipher and reboot but I don't see how to do that on the XG nor do I see a way to disable TLS 1.0.  How can this be done?

 

-Allan



This thread was automatically locked due to age.
  • 0 in reply to AllanD

    So what you are advising is that XG cannot pass compliance scans because of an old protocol that in most other devices has been disabled for sometime or they have the ability to disable.

    flosupport or AllenT is this really true?

    Ian

  • +1 in reply to rfcat_vk

    As of the latest update, "HW-SFOS_17.0.6_MR-6.SF300-181", this is what is still in the config files:

    SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:ECDH+3DES:DH+3DES:RSA+3DES:!aNULL:!MD5:!DSS
    SSLProtocol all -SSLv2 -SSLv3

    Sooooooo...... you still have to manually remove the 3DES ciphers and also add in the -TLSv1 -TLSv1.1 to the SSLProtocols line to disable them.   Also every time you do a firmware update this file gets overwritten and turns those all back on so you have to go back and manually fix it each time.

     

    I don't know why this hasn't been fixed or at least the option to turn it on and off added to the UI.

  • 0 in reply to AllanD

    This is extremely disappointing coming from a company that purports to be a security company.

     

    RSA encryption ciphers? See also "ROBOT."

    3DES? See also "SWEET32."

    TLS v1.0 and TLS v1.1?

    No ability to manually configure these settings for local security policy?

     

    Come on, Sophos. These should have been resolved ages ago, let alone when high/critical vulnerabilities about these exact things were announced. I will -never- recommend your products to anyone until you start treating security products with a security-first focus. All the features in the world mean nothing if you can't handle the basics.