Medium ELB Regional

Application Load Balancer should be configured with defensive or strictest desync mitigation mode

NIST

Description

Ensures Application Load Balancers use defensive or strictest desync mitigation mode to protect against HTTP desync attacks.

To configure desync mitigation mode for Application Load Balancers, follow these steps:

Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
On the navigation pane, under LOAD BALANCING, choose Load Balancers.
Select the Application Load Balancer.
Choose the Description tab, and find the Attributes section.
If 'routing.http.desync_mitigation_mode' is not set to 'defensive' or 'strictest', choose Edit attributes.
Set 'routing.http.desync_mitigation_mode' to 'defensive' or 'strictest'.

NIST