Rule Definition
Secure Socket Layer (SSL) technology is security that is implemented at the transport layer (see Transport-Layer Security for more information about transport-layer security). SSL allows web browsers and web servers to communicate over a secure connection. In this secure connection, the data is encrypted before being sent and then is decrypted upon receipt and before processing. Both the browser and the server encrypt all traffic before sending any data. SSL addresses the following important security considerations: Authentication, Confidentiality and Integrity
Remediation
Use TLS or DTLS in place of SSL.
Violation Code Sample
context = SSLContext.getInstance("SSL"); // Violation used protocol is not 'TLSv1.2' or 'DTLSv1.2'
Fixed Code Sample
context = SSLContext.getInstance("TLSv1.2"); // Violation FIXED
Reference
https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices
https://cwe.mitre.org/data/definitions/319.html
Related Technologies
Technical Criterion
PCI-DSS4-Requirement-4.2.1 - Strong cryptography and security protocols are implemented
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.