Impact of Disabling Weak Ciphers on App Service Environment - Microsoft Q&A (2024)

FAQs

What is the impact of removing weak ciphers? ›

The server looks at the supported ciphers and sends back all the ciphers it supports. If there are none then the SSL connection fails. So if you are using ciphers that are not supported prior to TLS 1.2 then no client using a lesser version will have any ciphers the server allows.

Risks Associated with Weak Cipher Suites

Weak cipher suites are a breeding ground for various cyber attacks. Hackers can exploit vulnerabilities in outdated encryption algorithms or key exchange methods to eavesdrop on confidential communications, intercept sensitive data, or even launch man-in-the-middle attacks.

Currently there is no official workaround to achieve this so you will need to upgrade your App Service Plan to premium to use this feature. Comment Use comments to ask for clarification, additional information, or improvements to the question.

Finally, there is the option for a “NULL” cipher, which simply means, the traffic should not be encrypted – so this option should definitely not be enabled. In short, you should disable known deprecated and discouraged ciphers, including DES, IDEA, 3DES, RC2, RC4, IDEA, ARIA, SEED, and NULL ciphers.

A cipher is a method used in cryptography for performing encryption or decryption. Essentially, it's a set of algorithms that you apply to your data (plaintext) to transform it into an unrecognizable form (ciphertext). This process helps to protect sensitive information from unauthorized access.

Weak cryptography can enable attackers to decrypt the intercepted data, modify it, and re-encrypt it before forwarding it to the intended recipient. This can lead to unauthorized access, data manipulation, or the injection of malicious content.

There are two cipher suites required for an App Service Environment; TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. If you wish to operate your App Service Environment with the strongest and most minimal set of cipher suites, then use just the two required ciphers.

You can manage some cipher suites directly from the Azure portal by navigating to the Protocols + Ciphers blade within your Azure API Management instance. However, please note that certain protocols or cipher suites, such as backend-side TLS 1.2, cannot be enabled or disabled through the Azure portal.

Vulnerabilities in SSL Suites Weak Ciphers is a Medium risk vulnerability that is also high frequency and high visibility. This is the most severe combination of security factors that exists and it is extremely important to find it on your network and fix it as soon as possible.

What are the three types of ciphers? ›

Cipher suites marked as “weak” by testing tools are still commonly used by web clients, and are not known to be exploitable. If a cipher suite is known to be exploitable, it will be marked as insecure instead of weak.

Note that a one-bit change in a plaintext or initialization vector (IV) affects all following ciphertext blocks. Decrypting with the incorrect IV causes the first block of plaintext to be corrupt but subsequent plaintext blocks will be correct.

Instead of secure mathematical algorithms to protect data, null ciphers use predefined blocks of data to obfuscate plain-text. No protection is actually provided by null ciphers and should not be used in production environments where confidentiality is required.