🏛️NIST 800-53 SC-8Rule: NIST-SC-008critical

Transmission Confidentiality and Integrity

Description

Protect the confidentiality and integrity of transmitted information.

⚠️ Risk Impact

Any unencrypted internal API call is a credential leak waiting to happen. East-west traffic (service-to-service) is often unencrypted on the assumption that 'internal' means 'safe' — an assumption that fails at the first lateral-movement breach.

🔍 How EchelonGraph Detects This

NIST-SC-008Automated scanner rule

EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as critical-severity findings with remediation guidance.

🔧 Remediation

Enforce TLS 1.2+ everywhere. Use mTLS for service-to-service (Istio, Linkerd, Cloudflare Tunnel, Cilium). Disable legacy protocols (TLS 1.0/1.1, SSL). Pin certificates for sensitive paths.

💀 Real-World Attack Scenario

An internal microservice communicated with the database over plaintext within a VPC. An attacker who compromised a pod in the same namespace ran tcpdump and captured database queries — including queries returning SSNs and password hashes. Wire-level eavesdropping bypassed every application-layer access control.

💰 Cost of Non-Compliance

Unencrypted traffic as breach contributor: 18% of 2024 breaches (Mandiant M-Trends). PCI-DSS 4.1: $5K-$100K/month fines + cardholder-data exposure liability.

📋 Audit Questions

  • 1.Are all internal connections encrypted? Show the mTLS posture.
  • 2.What TLS versions are accepted by load balancers? Any TLS 1.0/1.1?
  • 3.How are certificate expirations monitored?
  • 4.Is certificate pinning implemented for sensitive paths?

🎯 MITRE ATT&CK Mapping

T1040 — Network SniffingT1557 — Adversary-in-the-Middle

⚡ Common Pitfalls

  • ⛔External traffic encrypted; internal east-west traffic plaintext
  • ⛔TLS 1.0/1.1 left enabled 'for backward compatibility'
  • ⛔Certificate expiration monitoring missing — outages traced to expired certs

📈 Business Value

End-to-end encryption eliminates wire-level eavesdropping as an attack class. Strong mTLS for east-west traffic catches lateral-movement attempts.

⏱️ Effort Estimate

Manual

40-80 hours service-mesh deployment + per-service migration

With EchelonGraph

EchelonGraph evaluates TLS posture across load balancers + service mesh

🔗 Cross-Framework References

SOC2-CC6.7PCI-4.1

Automate NIST 800-53 SC-8 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →