HNSEC07-BP01 Enforce End-to-End TLS Encryption
Protect data integrity and confidentiality by enforcing TLS encryption for all application-layer communication, both within your cloud environment and across hybrid connections to on-premises systems. End-to-end TLS ensures that sensitive data is always encrypted in transit, even if it traverses untrusted networks.
Desired outcome: Sensitive application data remains protected from interception and tampering at all times between end users, on-premises infrastructure, and cloud workloads.
Benefits of establishing this best practice:
-
Ensures confidentiality and integrity of data in transit
-
Meets regulatory and customer expectations for data protection
-
Reduces risk of data breaches from network sniffing or man-in-the-middle attacks
-
Simplifies compliance reporting by demonstrating encryption controls
Implementation guidance
-
Configure firewall rules to only allow HTTPS traffic and block HTTP, ensuring all connections are encrypted.
-
Select the strongest cipher suites that terminate TLS connections.
-
Managed and deployed public certificates. For example, you can achieve this by using AWS Certificate Manager.
-
Managed private PKI (Public Key Infrastructure) as needed. For example, you can achieve this by using AWS Private Certificate Authority.
Resources
