A vulnerability can on a web server identified the following: Which of the following actions would most likely eliminate on path decryption attacks? (Select two).

Question

Options

• ADisallowing cipher suites that use ephemeral modes of operation for key agreement
• BRemoving support for CBC-based key exchange and signing algorithms
• CAdding TLS_ECDHE_ECDSA_WITH_AE3_256_GCMS_HA256
• DImplementing HIPS rules to identify and block BEAST attack attempts
• ERestricting cipher suites to only allow TLS_RSA_WITH_AES_128_CBC_SHA
• FIncreasing the key length to 256 for TLS_RSA_WITH_AES_128_CBC_SHA

• A
  2% (1)
• B
  55% (23)
• D
  26% (11)
• E
  12% (5)
• F
  5% (2)

Explanation

On-path decryption attacks, such as BEAST (Browser Exploit Against SSL/TLS) and other related vulnerabilities, often exploit weaknesses in the implementation of CBC (Cipher Block Chaining) mode. To mitigate these attacks, the following actions are recommended: Removing support for CBC-based key exchange and signing algorithms: CBC mode is vulnerable to certain attacks like BEAST. By removing support for CBC-based ciphers, you can eliminate one of the primary vectors for these attacks. Instead, use modern cipher modes like GCM (Galois/Counter Mode) which offer better security properties. Adding TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA256: This cipher suite uses Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) for key exchange, which provides perfect forward secrecy. It also uses AES in GCM mode, which is not susceptible to the same attacks as CBC. SHA-256 is a strong hash function that ensures data integrity.

No community discussion yet for this question.