TLS Misconfiguration on an External Endpoint
An external scan of a company's public IP range finds a load balancer terminating TLS for a customer portal. The cipher list includes TLS 1.0/1.1, RC4, and 3DES; the certificate is valid but the SAN list includes an internal hostname (intranet.corp.example). The LB also answers on port 8443 with an admin UI that returns a 200 and a login page; the scanner labels it 'informational.' The team's ticket says 'TLS 1.0 is required by 2% of clients; we cannot disable it.' The portal handles account logins but no card data. The admin UI on 8443 has default credentials documented in a vendor PDF indexed by a search engine.
1. Rank the three findings (legacy TLS, internal name in SAN, exposed admin UI) by risk and justify.
Read the worked answer
- Exposed admin UI with default creds - highest. Default credentials plus internet exposure is near-certain compromise; the 'informational' label is wrong because the scanner graded the port, not the auth. 2) Internal hostname in SAN - recon enabler; leaks internal naming and confirms intranet.corp.example exists, aiding phishing and lateral targeting. Not directly exploitable but lowers attacker cost. 3) Legacy TLS (1.0/1.1, RC4, 3DES) - real but lower for a non-card portal; the practical risk depends on client population and whether an active MITM is plausible. The 2%-of-clients argument is a business constraint, not a security justification, but it is the least urgent of the three. Ranking reflects exploitability and blast radius, not scanner severity labels.
2. How would you resolve the '2% of clients' objection without simply accepting the risk?
Read the worked answer
Measure the claim before honoring it. Instrument the LB to log TLS version and cipher per connection for 30 days; the '2%' is often a stale estimate. Then tier the response: keep TLS 1.2+ on the main portal, and if a small population genuinely cannot upgrade, isolate them on a separate legacy endpoint with reduced functionality (no login, or login + step-up), rate-limited and monitored, rather than weakening the primary endpoint for everyone. Set a dated deprecation with client outreach. This converts an unbounded 'we must support old clients' into a scoped, time-boxed exception with compensating controls - the defensible answer when the constraint is real.