News Item

The Netherlands - NCSC publishes factsheet Disable SSL 2.0 and upgrade OpenSSL

The Netherlands' National Cyber Security Centre publishes a new factsheet advising to Disable SSL 2.0 and upgrade OpenSSL.

Published on March 03, 2016

On 1 March, a group of researchers presented the DROWN attack methods for TLS. An attacker uses DROWN to abuse servers that still support SSL 2.0. Servers that run a vulnerable version of OpenSSL can be abused in the same way, regardless of whether they support SSL 2.0. An attacker who is able to intercept network traffic that is secured with TLS, may attempt to decrypt this traffic using the vulnerable server. This allows him to inspect the traffic.

The NCSC advises to always configure TLS on the basis of the IT security guidelines for Transport Layer Security. Therefore, disable SSL 2.0, install the most recent updates of OpenSSL and prefer cipher suites that provide forward secrecy on all servers.

This factsheet is aimed at IT administrators, information security professionals and IT managers.

 
Download the factsheet: NCSC Factsheet

For more information: NCSC Announcement

 

Stay updated - subscribe to RSS feeds of both ENISA news items & press releases!

News items:

http://www.enisa.europa.eu/media/news-items/news-wires/RSS

PRs:

http://www.enisa.europa.eu/media/press-releases/press-releases/RSS

We use cookies to ensure we give you the best browsing experience on our website. Find out more on how we use cookies and how you can change your settings.

Ok, I understand No, tell me more