+NET.3.2.A21 Temporary Decryption of Data Traffic (S)

NET.3.2.A21 Temporary Decryption of Data Traffic (S)

Encrypted connections to untrusted networks SHOULD be decrypted temporarily in order to verify the protocol and check the data for malware. In so doing, the relevant legal framework conditions SHOULD be taken into consideration.

The component that temporarily decrypts data traffic SHOULD prevent the use of outdated encryption options and cryptographic algorithms.

The TLS proxy SHOULD also be able to check whether certificates are trustworthy. If a certificate is not trustworthy, it SHOULD be possible to reject the respective connection. It SHOULD be possible to subsequently integrate proprietary certificates in order to be able to configure and check “internal” root certificates, as well. Pre-configured certificates SHOULD be checked and removed if they are not required.

1. Преглед

1.1 Препратки

1.2 Идентифицирани изисквания

1.3 Свързани регулации

2. Идентифицирани изисквания

Изисквания

3. Свързани регулации

Регулации

Свързани задачи

Връзки
blocks G 0.22 Manipulation of Information
blocks G 0.41 Sabotage
blocks G 0.43 Attack with Specially Crafted Messages