Findings library
Close the finding your scanner named.
One page per finding, under the name your scanner, pentest report, or customer review used. Each page covers what the finding means, the fix, what to do when a system can't change, and where it lands in your Risk Register.
Protocols and ciphers
TLS 1.0 or 1.1 still enabled
Turning off TLS 1.0 and 1.1 on every listener, and documenting the systems that can't reach TLS 1.2.
TLS Version 1.0 Protocol DetectionTLS Version 1.1 Protocol DeprecatedWeak cipher suites (SWEET32, 3DES)
Removing Triple DES from every TLS listener, and documenting the exception for legacy assets that offer nothing else.
SWEET323DES cipher suites supportedRC4 cipher suites enabled
Removing RC4 from every TLS listener, and documenting the legacy systems that can't drop it.
SSL RC4 Cipher Suites Supported (Bar Mitzvah)RC4 cipher suites supportedKey exchange
Weak Diffie-Hellman parameters (Logjam)
Moving key exchange to 2048-bit groups or elliptic curves, and documenting the devices held to 1024-bit.
SSL/TLS Diffie-Hellman Modulus <= 1024 Bits (Logjam)Weak Diffie-Hellman parametersSSL Labs grade capped at B (no forward secrecy)
Enabling ECDHE key exchange so recorded traffic stays private, which also lifts the SSL Labs grade cap.
No forward secrecyGrade capped to BSSH weak key exchange algorithms enabled
Removing SHA-1 and 1024-bit SSH key exchange, putting hybrid post-quantum key exchange first where supported, and documenting devices that can't change.
SSH Weak Key Exchange Algorithms EnabledSSH Server CBC Mode Ciphers EnabledKeys and certificates
Remote access and edge gear
SSL VPN tunnel mode no longer supported (FortiOS 7.6.3)
Moving FortiGate SSL VPN users to IPsec or a zero trust gateway before FortiOS 7.6.3, or documenting a dated hold on 7.4.
SSL VPN tunnel mode no longer supportedSSL VPN tunnel mode is no longer available in the GUI and CLIExposed admin panel
Taking management interfaces off the internet or behind a separate identity gate, and documenting the exceptions.
Exposed admin panelExposed admin interfaceCredentials
Unsupported software
When a system can't change
Some findings sit on hardware or vendor software that can't take the fix. Those get a documented decision instead: compensating controls, a risk-acceptance record your assessor can read, and a date to revisit it. How compensating controls work for legacy systems.
Need findings closed, or documented so they stay open with your assessor's acceptance?