Plain HTTP is used
- GG_ID: GG_IAC_0001
- Severity: HIGH
- Complexity: LOW
- Categories: NETWORK
- Providers: AWS, Azure
- Potential data exposure: True
- Visible in logs: False
- User interaction required: True
- Privileges required: False
#
DescriptionPlain HTTP should not be used, it is unencrypted. HTTPS should be used instead.
#
ImpactData is transmitted unencrypted, an eavesdropper has access to every request and response. An intruder can gain access to more systems by listening to unencrypted authentication requests. It also facilitates man-in-the-middle attacks.
#
Remediation guidelinesIdentify and apply the policy for the concerned resource which enforces HTTPS only