---
title: "Reducing Risk: SSL/Early TLS Mitigation and Migration"
description: 30 June 2018 is PCI DSS deadline for disabling SSL/early TLS and implementing a more secure encryption protocol.
image: https://blog.pcisecuritystandards.org/hubfs/2017-Blog/ssl-tsl-migrating.jpg
---

[< Return to Blog Home](https://blog.pcisecuritystandards.org) [Print](https://blog.pcisecuritystandards.org/reducing-risk-ssl-early-tls-mitigation-and-migration#)

# [Reducing Risk: SSL/Early TLS Mitigation and Migration](https://blog.pcisecuritystandards.org/reducing-risk-ssl-early-tls-mitigation-and-migration)

 Posted by [Laura K. Gray](https://blog.pcisecuritystandards.org/author/laura-k-gray) on 28 Jul, 2017 in [eCommerce](https://blog.pcisecuritystandards.org/topic/ecommerce) and [Patching](https://blog.pcisecuritystandards.org/topic/patching) and [Awareness](https://blog.pcisecuritystandards.org/topic/awareness) and [TLS/SSL](https://blog.pcisecuritystandards.org/topic/tls-ssl) and [PCI DSS](https://blog.pcisecuritystandards.org/topic/pci-dss) and [Encryption](https://blog.pcisecuritystandards.org/topic/encryption)

![ssl-tsl-migrating.jpg](https://blog.pcisecuritystandards.org/hs-fs/hubfs/2017-Blog/ssl-tsl-migrating.jpg?width=800&name=ssl-tsl-migrating.jpg "ssl-tsl-migrating.jpg")

<https://www.linkedin.com/shareArticle?mini=true&url=https://blog.pcisecuritystandards.org/reducing-risk-ssl-early-tls-mitigation-and-migration>

<https://www.facebook.com/share.php?u=https://blog.pcisecuritystandards.org/reducing-risk-ssl-early-tls-mitigation-and-migration>

<https://twitter.com/intent/tweet?original_referer=https://blog.pcisecuritystandards.org/reducing-risk-ssl-early-tls-mitigation-and-migration&url=https://blog.pcisecuritystandards.org/reducing-risk-ssl-early-tls-mitigation-and-migration&source=tweetbutton&text=Reducing%20Risk:%20SSL/Early%20TLS%20Mitigation%20and%20Migration> 

[mailto:?subject=Check%20out%20this%20article&body=https://blog.pcisecuritystandards.org/reducing-risk-ssl-early-tls-mitigation-and-migration](mailto:?subject=Check%20out%20this%20article&body=https://blog.pcisecuritystandards.org/reducing-risk-ssl-early-tls-mitigation-and-migration)

 

*Is your organization still using the SSL/early TLS protocols? Do you work with online and e-commerce partners or customers who haven’t yet started the migration away from SSL/early TLS to a more secure encryption protocol? There are many serious vulnerabilities in SSL and early TLS that left unaddressed put organizations at risk of being breached.  As there are no fixes or patches that can adequately repair SSL or early TLS, it’s critically important that organizations upgrade to a secure alternative as soon as possible, and disable any fallback to both SSL and early TLS.*

 

*[**In our previous post**](https://mail.virtualinc.com/owa/redir.aspx?C=d0kNwF_qMEODV7NYRGWMPphwt3R72tQI3N1lRXRjq_En-Kh4V8k_7lDZdHORQepsLFeWpH12zfI.&URL=https%3a%2f%2fblog.pcisecuritystandards.org%2fare-you-ready-for-30-june-2018-sayin-goodbye-to-ssl-early-tls), we highlighted key questions and answers around the 30 June 2018 PCI Data Security Standard (PCI DSS) deadline for disabling SSL/early TLS protocols to safeguard payment data. Here we look specifically at steps organizations can take now to mitigate risks and begin the migration process.    *

 

**How can risk-mitigation controls help organizations still using SSL/early TLS?**

For environments currently using SSL/early TLS protocols, the implementation and continued use of risk-mitigation controls helps protect the vulnerable environment until migration to a secure alternative is complete.

**What are examples of risk-mitigation controls that organizations can put in place?**

Some controls that may help with risk reduction include, but are not limited to:

- Minimizing the attack surface as much as possible, by consolidating functions that use vulnerable protocols onto fewer systems, and reducing the number of systems supporting the protocols.
- Removing or disabling use of web browsers, JavaScript, and security-impacting session cookies where they are not needed.
- Restricting the number of communications using the vulnerable protocols by detecting and blocking requests to downgrade to a lesser protocol version.
- Restricting use of the vulnerable protocols to specific entities; for example, by configuring firewalls to permit SSL/early TLS only to known IP addresses (such as business partners requiring use of the protocols), and blocking such traffic for all other IP addresses.
- Enhancing detection/prevention capabilities by expanding coverage of intrusion-protection systems, updating signatures, and blocking network activity that indicates malicious behavior.
- Actively monitoring for suspicious activity – for example, identifying unusual increases in requests for fallback to vulnerable protocols – and responding appropriately.

Additionally, entities should ensure all applicable PCI DSS requirements are also in place, including:

- Proactively keeping informed about new vulnerabilities; for example, subscribing to vulnerability notification services and vendor support sites to receive updates about new vulnerabilities as they emerge.
- Applying vendor recommendations for configuring their technologies securely.

**What are some SSL/early TLS migration options?**

Examples of additional cryptographic measures that may be implemented and used as a security control to replace SSL/early TLS may include:

- Upgrading to a current, secure version of TLS that is implemented securely and configured to not accept fallback to SSL or early TLS.
- Encrypting data with strong cryptography before sending over SSL/early TLS (for example, using field-level or application-level encryption to encrypt the data prior to transmission).
- Setting up a strongly-encrypted session first (e.g. IPsec tunnel), then sending data over SSL within secure tunnel.

Additionally, the use of two-factor authentication may be combined with the above controls to provide authentication assurance. At least one of the factors must not rely on transmission over the legacy SSL/early TLS connection.

The choice of an alternative cryptographic control will depend on the technical and business needs for a particular environment.

While 30 June 2018 is still a year away, it takes time to migrate to more secure protocols and organizations should not delay in starting this process.

[![Download Guidance for Migrating from SSL and Early TLS](https://no-cache.hubspot.com/cta/default/281302/1e14979b-2625-4998-8bd9-ffc64b1e8639.png)](https://cta-redirect.hubspot.com/cta/redirect/281302/1e14979b-2625-4998-8bd9-ffc64b1e8639)

 

  

### LIKE WHAT YOU READ?

Subscribe to the PCI Perspectives blog to receive insights, information and practical resources to help your organization protect payment data.

[Subscribe Here](https://training.pcisecuritystandards.org/subscribe-to-pci-perspectives-blog)

![Laura K. Gray](https://blog.pcisecuritystandards.org/hubfs/Headshots/laura-gray.jpg)

[ Laura K. Gray ](https://blog.pcisecuritystandards.org/author/laura-k-gray)

[Twitter ](https://www.twitter.com/pcissc) [Email](mailto:blog@pcisecuritystandards.org) [Website](http://www.pcisecuritystandards.org)

 The PCI Security Standards Council (PCI SSC) is a global forum that brings together payments industry stakeholders to develop and drive adoption of data security standards and resources for safe payments worldwide.

[< Return to Blog Home](https://blog.pcisecuritystandards.org) [Print](https://blog.pcisecuritystandards.org/reducing-risk-ssl-early-tls-mitigation-and-migration#)