Detections
Analytics

8.1 Ensure 'require_secure_transport' is set to 'ON'

Information

All network traffic must use SSL/TLS when traveling over untrusted networks.

Enabling Secure Sockets Layer (SSL) will allow clients to encrypt network traffic and verify the identity of the server. The SSL/TLS-protected MySQL protocol helps to prevent eavesdropping and man-in-the-middle attacks.

Solution

Follow the procedures as documented in the MySQL 9.7 Reference Manual to set up SSL.

Set global policy to force SSL for all connections:

set persist require_secure_transport=ON;

Impact:

Enabling SSL could impact network traffic inspection.

See Also

https://workbench.cisecurity.org/benchmarks/22688

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: MySQLDB

Control ID: c161091f0ddec64e2976fe23ffd14e1c4c4d117a0d9257486860ef6730cd78a7