Page Comparison

Only standard and mature cryptographic algorithms, operation modes, key lengths ciphers, and implementations MUST be used.

External transmissions

1. All external access and transmission MUST only be possible with HTTPS and valid certificates.

2. In addition to this, see HTTP Strict Transport Security (HSTS) requirement in section 8.12 Client-Side Securityfor protection UIs.

3. Perfect Forward Secrecy SHOULD be activated on external HTTPS servers.

4. MUST only be sent with anti-caching response headers (see Appendix A: Requirements for HTTP Security Header).

Internal transmissions

1. All internal access and transmissions MUST only be possible with HTTPS and valid certificates.

2. Application-internal (service-to-service) transmissions MAY be unencrypted if transmitted within trusted environments.

General TransmissionGeneral Transmission

1. Transmission of sensitive data SHOULD generally only be possible via TLS/HTTPS.

2. In cases where access requires HTTPS, requests via HTTP MUST be redirected to HTTPS. This SHOULD be implemented with a permanent redirection (HTTP 301).

3. HTTPS servers MUST only support current secure ciphers and protocols. Insecure ones (e.g. SSLv2 and RC4 cipher) MUST be deactivated.

4. Confidential data MUST only be sent within the HTTP Request Body (e.g. via HTTP POST) but not within URLs (exception: object IDs).

Transmission on untrusted channels (e.g. the Internet) MUST

1. only be possible with HTTPS using valid certificates.

2. using HTTP Strict Transport Security (HSTS) headers 8.12 Client-Side Security and

3. only be sent with anti-caching response headers (see Appendix A: Requirements for HTTP Security Header).

Encryption at Rest

1. Confidential data MUST be encrypted before stored on the client-side or on external cloud environments.Confidential data SHOULD be encrypted before stored on internal systems.

2. User passwords MUST be persisted with suitable methods (see section 8.6 User Passwords I: Strength and Usage).