cipherrun 0.3.0

A fast, modular, and scalable TLS/SSL security scanner written in Rust
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145

id: hipaa
name: HIPAA Security Rule
version: 1.0
description: Health Insurance Portability and Accountability Act - Technical Safeguards for ePHI Transmission Security
organization: U.S. Department of Health and Human Services (HHS)
effective_date: 2003-04-21

requirements:
  - id: HIPAA-164.312-e-1
    name: Transmission Security - Encryption
    description: Implement technical security measures to guard against unauthorized access to ePHI transmitted over electronic networks
    category: Protocol Security
    severity: high
    remediation: |
      Enable strong encryption for all ePHI transmission:
      - Use TLS 1.2 or TLS 1.3 for network communications
      - Disable obsolete protocols (SSLv2, SSLv3, TLS 1.0, TLS 1.1)
      - Implement end-to-end encryption where required
    rules:
      - type: ProtocolVersion
        allowed:
          - TLS 1.2
          - TLS 1.3
        denied:
          - SSLv2
          - SSLv3
          - TLS 1.0
          - TLS 1.1

  - id: HIPAA-164.312-e-2
    name: Integrity Controls
    description: Implement security measures to ensure ePHI is not improperly altered or destroyed during transmission
    category: Cipher Security
    severity: high
    remediation: |
      Use authenticated encryption to ensure data integrity:
      - Enable AEAD cipher suites (AES-GCM, ChaCha20-Poly1305)
      - These provide both confidentiality and message authentication
      - Disable cipher suites without proper integrity protection
    rules:
      - type: CipherSuite
        preferred_patterns:
          - ".*_GCM.*"
          - ".*_CHACHA20_POLY1305.*"

  - id: HIPAA-164.312-a-1
    name: Access Control - Encryption Strength
    description: Strong encryption algorithms must be used to protect ePHI
    category: Cipher Security
    severity: critical
    remediation: |
      Disable weak and broken encryption algorithms:
      - NULL ciphers (no encryption)
      - EXPORT ciphers (deliberately weakened)
      - DES, 3DES (obsolete)
      - RC4 (broken stream cipher)

      Use only strong, modern cipher suites with AES-256 or AES-128.
    rules:
      - type: CipherSuite
        denied_patterns:
          - ".*_NULL_.*"
          - ".*_EXPORT_.*"
          - ".*_DES_.*"
          - ".*_3DES_.*"
          - ".*_RC4_.*"

  - id: HIPAA-164.312-a-2-iv
    name: Encryption Key Management
    description: Implement procedures for creating, changing, and safeguarding encryption keys
    category: Certificate Security
    severity: high
    remediation: |
      Ensure proper cryptographic key management:
      - Use RSA keys of at least 2048 bits
      - Use ECC keys of at least 256 bits
      - Implement key rotation policies
      - Protect private keys with access controls
    rules:
      - type: CertificateKeySize
        min_rsa_bits: 2048
        min_ecc_bits: 256

  - id: HIPAA-164.312-b
    name: Audit Controls - Certificate Validation
    description: Implement procedures to record and examine activity in systems containing ePHI
    category: Certificate Security
    severity: high
    remediation: |
      Ensure proper certificate validation and monitoring:
      - Verify certificate chains to trusted CAs
      - Monitor certificate expiration dates
      - Maintain audit logs of certificate validation failures
      - Implement certificate revocation checking (OCSP/CRL)
    rules:
      - type: CertificateValidation
        require_valid_chain: true
        require_unexpired: true

  - id: HIPAA-164.308-a-8
    name: Evaluation - No Known Vulnerabilities
    description: Perform periodic technical evaluations to ensure security measures are appropriate
    category: Vulnerability
    severity: critical
    remediation: |
      Regularly assess and remediate TLS/SSL vulnerabilities:
      - Patch Heartbleed, POODLE, BEAST, CRIME, etc.
      - Keep TLS libraries and server software updated
      - Perform quarterly vulnerability assessments
      - Document and track remediation efforts
    rules:
      - type: Vulnerability

  - id: HIPAA-164.312-c-1
    name: Integrity - Strong Hash Functions
    description: Implement policies to ensure data integrity using approved hash functions
    category: Certificate Security
    severity: high
    remediation: |
      Use strong cryptographic hash functions:
      - SHA-256, SHA-384, or SHA-512 for certificate signatures
      - Avoid MD5 and SHA-1 (both cryptographically broken)
    rules:
      - type: SignatureAlgorithm
        allowed:
          - sha256
          - sha384
          - sha512
        denied:
          - md5
          - sha1

  - id: HIPAA-164.312-e-2-i
    name: Forward Secrecy
    description: Implement mechanisms to protect session keys from compromise
    category: Cipher Security
    severity: medium
    remediation: |
      Enable Perfect Forward Secrecy (PFS):
      - Use ECDHE or DHE key exchange
      - Ensures session keys cannot be decrypted even if long-term keys are compromised
      - Disable static RSA key exchange
    rules:
      - type: ForwardSecrecy
        required: true