2cac8686_plication_Security_and_Privacy__Derived_Security_Controls
Failure to encrypt online communications [Derived Security Controls] 
Identify and record all information that should be encrypted in transit Ensure the encryption method (e.g. SSL/TLS) is configured correctly and that certificate are valid Maintain a list of all certificates and ensure they are renewed before expiry Consider using Extended Validation (EV) digital certificates to provide a higher level of identity assurance to users Do not use SSL v2, and preferably enable TLS 1.2), disable weak ciphers (i.e.enable ciphers with 128 bi strength or greater) and avoid weak ciphers (e.g. RC4) or those that provide no encryption or no authentication i.e. null ciphers) Ensure the information cannot be accessed without encryption When web pages are sent over SSL/TLS, ensure every single component in the page (e.g. images, style sheets, scripts and third-party hosted content) is also sent over SSL/TLS Never send session identifiers (e.g. cookies identifying an authenticated user) over unencrypted connections Ensure SSL/TLS websites are only accessible by hostnames included in the certificate, and not by IP address) Consider making websites completely "SSL/TLS only Review transport encryption best practice periodically and update configurations as required
Privacy : Application Security and Privacy
Derived Security Controls