ISR05: Insecure Use of Cryptography

How ISR05: Insecure Use of Cryptography works

Internal traffic and storage go unencrypted or weakly encrypted, so anyone already on the network or holding a disk can read credentials and data. The weakness lives in the places nobody re-reviews after go-live: switch, PDU and out-of-band management planes still answering Telnet and plain HTTP, an internal web application whose certificate expired two years ago and whose users click through the warning, a jump host still offering TLS 1.0, a NAS volume with no encryption, and a backup share holding full virtual machine images in the clear. Perimeter TLS is measured, reported and renewed on a calendar; the same estate one hop inside runs on whatever defaults were set the day the device was racked.

It survives because nothing breaks. Cleartext works, an expired certificate still encrypts, a client that validates nothing never shows an error, and an unencrypted backup restores faster, so no ticket is ever raised and no external scanner sees any of it. After initial access - a phished laptop, a compromised print server - an attacker with a mirror port or an on-path position turns that silence into credentials and session content, then into privileged accounts, while a stolen disk or tape turns it into the whole dataset with no account needed at all. The three chapters below take one surface each: Cleartext Management Protocols covers protocols with no encryption at all, Weak TLS On Internal Services covers encryption that exists but does not authenticate, and Unencrypted Data At Rest And Backups covers the bytes sitting on disks, volumes and media.

Keywords: cleartext protocols, internal tls, credential sniffing, self-signed certificate, full disk encryption, unencrypted backup

Examples/Proof

• Passive credential capture
  • Take a mirror port on a lab management VLAN and capture for one change window. Any FTP, Telnet, HTTP Basic or LDAP simple bind credential recoverable from the pcap is the finding.
• Management-plane port sweep
  • Sweep the management segment for 21/23/69/80/161/389 and record what answers with a banner. A device answering Telnet while its SSH listener is closed cannot be migrated by configuration alone.
• Certificate inventory diff
  • Pull the certificate from every internal listener and sort by expiry and issuer. Expired, self-signed or 1024-bit certificates still in production show that nothing on the network validates them.
• Offline volume read
  • Boot an authorised test laptop from live media and mount its system volume read-only. A filesystem that mounts with no unlock prompt proves the disk carries no encryption.

Detection and Monitoring

• Cleartext protocol counters
  • Count flows to 21/23/69/512-514 and to 389 with simple bind per source in NetFlow or the firewall log; any non-zero count from a management segment is a finding, not a baseline.
• TLS version and suite telemetry
  • Have the internal load balancer and IDS record the negotiated version and cipher per connection; TLS 1.0/1.1, RC4 or 3DES appearing at all names the client that still needs fixing.
• Encryption state drift
  • Report BitLocker, LUKS and FileVault status from the endpoint agent daily; a host flipping from protected to suspended, or a newly built host reporting nothing, is the alert.

How to fix and prevent ISR05: Insecure Use of Cryptography

1. Remove the protocols that have no secure mode
   • Telnet, FTP, TFTP, rsh and SNMPv1/v2c cannot be made confidential; migrate to SSH, SFTP, SCP and SNMPv3 authPriv rather than tuning them.
2. Make internal TLS a managed service
   • Issue every internal listener a short-lived certificate from a tracked internal CA through ACME or autoenrolment, and set a floor of TLS 1.2 with AEAD suites.
3. Turn certificate validation on in the clients
   • Encryption without hostname and chain verification defeats passive sniffing only. Partial control: a client that trusts anything is still fully interceptable by an on-path attacker.
4. Encrypt endpoints, servers and storage at rest
   • BitLocker with TPM plus PIN, LUKS2, FileVault and array or datastore encryption, with escrowed recovery keys and a standing report of unprotected hosts.
5. Encrypt backups and anything that leaves the building
   • Hold backup keys outside the backup platform. Partial control: an operator with both repository and key access still reads everything, which is why the surrounding access model matters as much as the cipher.

Prevention Checklist

• No listener on any internal segment answers Telnet, FTP, TFTP, rsh or SNMPv1/v2c
• Every internal TLS endpoint presents an unexpired certificate from a tracked internal CA and refuses TLS 1.1 and below
• Every laptop, server system volume and NAS volume reports an enabled full-disk or volume encryption state with an escrowed recovery key
• Backup repositories and offsite media are encrypted with keys stored outside the backup platform

Last updated 2026-08-24