cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
BenEllis
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 1 of 6

Disabling TLS 1.0 and 1.1 on Siem

Do we have any documentation on Disabling TLS 1.0 and 1.1 on all siem devices?  We are getting this detection on a nessus scan for the receiver.

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

5 Replies
vsenthil
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: Disabling TLS 1.0 and 1.1 on Siem

Hello @BenEllis,

May I know what's the ESM version you're running ?

Also let us know if you're running standalone device or combo box ?

Kindly note that ESM uses TLS 1.2 from version 11.4.2 and we recommend you to upgrade the ESM version to our latest version 11.5.6 and check if your vulnerability scanner still reports the vulnerability.

BenEllis
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 6

Re: Disabling TLS 1.0 and 1.1 on Siem

I am on 11.5.5, and standalone, our vulnerability scanner showed it still vulnerable which we thought was odd. because we have 2 other environments on 2 other environments and only 1 showed vulnerable.

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

BenEllis
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 6

Re: Disabling TLS 1.0 and 1.1 on Siem

Further looking at the report. Looks like its rsyslog, thats the issue. With our product. Is there steps we can use to disable Rsyslog TLS 1.0/1.1. i know siem uses MLOS so i wanted to ask you if there were specific steps before i try something that could possibly be not supported. 

 

TLS Version 1.0 Protocol Detectiontcp6514The remote service accepts connections encrypted using TLS 1.0. TLS 1.0 has a
number of cryptographic design flaws. Modern implementations of TLS 1.0
mitigate these problems, but newer versions of TLS like 1.2 and 1.3 are
designed against these flaws and should be used whenever possible.

As of March 31, 2020, Endpoints that aren’t enabled for TLS 1.2
and higher will no longer function properly with major web browsers and major vendors.

PCI DSS v3.2 requires that TLS 1.0 be disabled entirely by June 30,
2018, except for POS POI terminals (and the SSL/TLS termination
points to which they connect) that can be verified as not being
susceptible to any known exploits.
TLS Version 1.1 Protocol Deprecatedtcp6514The remote service accepts connections encrypted using TLS 1.1. TLS 1.1 lacks support for current and recommended
cipher suites. Ciphers that support encryption before MAC computation, and authenticated encryption modes such as GCM
cannot be used with TLS 1.1

As of March 31, 2020, Endpoints that are not enabled for TLS 1.2 and higher will no longer function properly with major
web browsers and major vendors.

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

BenEllis
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 6

Re: Disabling TLS 1.0 and 1.1 on Siem

whats odd is when i run openssl ciphers -v i only see SSLv3 and TLSv1.2

 

When we check the SSLCipherSuite.conf we have.

 

SSLCipherSuite HIGH:!aNULL:!3DES:!RC4:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256
SSLOpenSSLConfCmd Curves secp384r1:secp521r1
SSL Protocol TLSv1.2:TLSv1.3

 

And rebooted but didnt matter. 

 

 

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

vsenthil
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 6

Re: Disabling TLS 1.0 and 1.1 on Siem

Thanks for providing the detailed output. Let me check internally and update you how we can take this further. 

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community