Plain HTTP is used
- GG_ID: GG_IAC_0001
- Severity: HIGH
- Complexity: LOW
- Categories: NETWORK
- Providers: AWS, Azure
- Potential data exposure: True
- Visible in logs: False
- User interaction required: True
- Privileges required: False
Description#
Plain HTTP should not be used, it is unencrypted. HTTPS should be used instead.
Impact#
Data is transmitted unencrypted, an eavesdropper has access to every request and response. An intruder can gain access to more systems by listening to unencrypted authentication requests. It also facilitates man-in-the-middle attacks.
Remediation guidelines#
Identify and apply the policy for the concerned resource which enforces HTTPS only