What cryptographic standards do you use to protect data in transit? (e.g., TLS 1.2+)
Explanation & Context
Explanation of the Question:
This question is asking about the specific cryptographic protocols your organization uses to secure data while it is being transferred between different systems or over the internet. "Data in transit" refers to data that is moving from one place to another, such as when you send an email, browse a website, or transfer files between servers. The goal is to ensure that this data cannot be easily intercepted or read by unauthorized parties.
Why It Matters:
Using strong cryptographic standards like TLS (Transport Layer Security) 1.2 or higher is crucial because it helps protect the confidentiality and integrity of data. When data is encrypted using these standards, it is scrambled in a way that only the intended recipient can unscramble it. This prevents attackers from eavesdropping on communications or tampering with the data. For example, when you visit a website using HTTPS, your connection to that site is secured using TLS, ensuring that your data (like passwords or personal information) is protected from prying eyes.
Example of Evidence:
To demonstrate fulfillment of this question, you might provide documentation showing that your web servers are configured to use TLS 1.2 or higher for all HTTPS connections. This could include server configuration files, network diagrams, or results from security scans that confirm the use of these cryptographic standards. Additionally, you might show logs or reports from your monitoring tools that indicate all data transfers comply with the required cryptographic protocols.
Example Responses
Example Response 1
We utilize TLS 1.2+ to secure all data in transit. This is enforced through Heroku's platform settings and confirmed via regular security audits and penetration testing reports.
Example Response 2
We employ TLS 1.2+ for all data in transit. This is achieved through AWS Certificate Manager for SSL/TLS certificates and is consistently verified through our automated security compliance checks and third-party security assessments.
Example Response 3
As our software is exclusively on-premises and does not involve data transfer over public networks, the use of TLS 1.2+ for data in transit is not applicable. However, we ensure secure data handling within our internal network using industry-standard encryption protocols.
