Medium
ELB
Regional
Classic Load Balancer should be configured with defensive or strictest desync mitigation mode
NISTISO 27001HIPAA
Description
This check ensures that Classic Load Balancers with SSL/HTTPS listeners are configured with a security policy that includes defensive or strictest desync mitigation mode to protect against HTTP desync attacks.
Remediation
To configure a security policy with desync mitigation mode for Classic Load Balancers, follow these steps:
Steps
- Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
- On the navigation pane, under LOAD BALANCING, choose Load Balancers.
- Select the Classic Load Balancer.
- Choose the Listeners tab.
- For the SSL or HTTPS listener, choose Change under the Cipher column.
- Select a security policy that includes defensive or strictest desync mitigation mode.
Compliance
NISTISO 27001HIPAA