[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsc-8":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sc-8","SC-8","Transmission Confidentiality and Integrity",88,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The confidentiality and\u002For integrity of information must be protected while it is being transmitted.\n\n**In practice.** This means TLS for web, API and email traffic using current protocol versions and strong cipher suites, encrypted VPNs or private links for site-to-site traffic, and encrypted management protocols such as SSH instead of Telnet. Auditors look for configuration standards, TLS scan results, certificate inventories and evidence that unencrypted protocols are disabled. ISO\u002FIEC 27001 cryptography controls and GDPR security requirements point the same way. Certificates should be inventoried and renewed automatically to avoid outages.\n\n**Common gaps.** Internal traffic is often left unencrypted on the assumption that the network is trusted. Legacy protocols and outdated TLS versions survive on older systems and appliances. Email between organisations may still travel without enforced encryption.","Protect the [Selection: confidentiality; integrity] of transmitted information.\nDiscussion: Protecting the confidentiality and integrity of transmitted information applies to internal and external networks as well as any system components that can transmit information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of information can be accomplished by physical or logical means. Physical protection can be achieved by using protected distribution systems. A protected distribution system is a wireline or fiber-optics telecommunications system that includes terminals and adequate electromagnetic, acoustical, electrical, and physical controls to permit its use for the unencrypted transmission of classified information. Logical protection can be achieved by employing encryption techniques.\n\nOrganizations that rely on commercial providers who offer transmission services as commodity services rather than as fully dedicated services may find it difficult to obtain the necessary assurances regarding the implementation of needed controls for transmission confidentiality and integrity. In such situations, organizations determine what types of confidentiality or integrity services are available in standard, commercial telecommunications service packages. If it is not feasible to obtain the necessary controls and assurances of control effectiveness through appropriate contracting vehicles, organizations can implement appropriate compensating controls.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"johnson-controls-ics-controllers-transmit-credentials-in-cleartext","Johnson Controls ICS Controllers Transmit Credentials in Cleartext","2026-10-01T18:22:52.992+00:00",{"slug":25,"title":26,"published_at":27},"openai-ai-agents-leaked-user-images-to-third-party-hosts","OpenAI AI Agents Leaked User Images to Third-Party Hosts","2026-09-26T20:21:57.994+00:00",{"slug":29,"title":30,"published_at":31},"elementor-csrf-flaw-enables-rogue-admin-account-creation","Elementor CSRF Flaw Enables Rogue Admin Account Creation","2026-09-26T12:20:52.067+00:00",{"slug":33,"title":34,"published_at":35},"elementor-csrf-flaw-enables-unauthorized-admin-account-creation","Elementor CSRF Flaw Enables Unauthorized Admin Account Creation","2026-09-25T20:20:22.675+00:00",{"slug":37,"title":38,"published_at":39},"critical-flaws-in-eufy-smart-cameras-expose-users-to-remote-code-execution","Critical Flaws in Eufy Smart Cameras Expose Users to Remote Code Execution","2026-09-24T21:22:00.489+00:00",{"slug":41,"title":42,"published_at":43},"fbi-cjis-v61-raises-the-bar-on-encryption-and-vulnerability-scanning","FBI CJIS v6.1 Raises the Bar on Encryption and Vulnerability Scanning","2026-09-21T16:21:54.052+00:00",{"slug":45,"title":46,"published_at":47},"hard-coded-credentials-and-cleartext-transmission-expose-eld-telemetry-data","Hard-Coded Credentials and Cleartext Transmission Expose ELD Telemetry Data","2026-09-17T18:23:21.435+00:00",{"slug":49,"title":50,"published_at":51},"iranian-chosen-brick-malware-targets-dissidents-and-activists-worldwide","Iranian 'Chosen Brick' Malware Targets Dissidents and Activists Worldwide","2026-09-16T12:20:21.643+00:00",{"slug":53,"title":54,"published_at":55},"commercial-vpn-security-gaps-leave-high-risk-users-exposed","Commercial VPN Security Gaps Leave High-Risk Users Exposed","2026-09-02T16:21:56.745+00:00",{"slug":57,"title":58,"published_at":59},"bgp-hijack-poisons-virtualizor-software-update-channel","BGP Hijack Poisons Virtualizor Software Update Channel","2026-09-02T12:20:37.531+00:00",{"slug":61,"title":62,"published_at":63},"android-17-brings-os-wide-encryption-to-shield-dns-queries-from-network-providers","Android 17 Brings OS-Wide Encryption to Shield DNS Queries from Network Providers","2026-08-28T20:21:38.909+00:00",{"slug":65,"title":66,"published_at":67},"critical-rce-flaws-in-unitree-g1-robot-expose-risks-of-unsecured-embedded-systems","Critical RCE Flaws in Unitree G1 Robot Expose Risks of Unsecured Embedded Systems","2026-08-28T14:21:36.64+00:00",[69,74,79,83,88,93],{"slug":70,"name":71,"problem":72,"stories":73},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",30,{"slug":75,"name":76,"problem":77,"stories":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",20,{"slug":80,"name":81,"problem":82,"stories":78},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":84,"name":85,"problem":86,"stories":87},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",18,{"slug":89,"name":90,"problem":91,"stories":92},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",15,{"slug":94,"name":95,"problem":96,"stories":97},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",10,[99,105,111,116,121,126,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"gdpr","32","Article 32","Security of processing",65,{"family":106,"item":107,"code":108,"title":109,"together":110},"cis","3","Control 3","Data Protection",51,{"family":106,"item":112,"code":113,"title":114,"together":115},"6","Control 6","Access Control Management",42,{"family":5,"item":117,"code":118,"title":119,"together":120},"ac-2","AC-2","Account Management",41,{"family":106,"item":122,"code":123,"title":124,"together":125},"13","Control 13","Network Monitoring and Defense",33,{"family":100,"item":127,"code":128,"title":129,"together":130},"25","Article 25","Data protection by design and by default",29,{"family":106,"item":132,"code":133,"title":134,"together":135},"7","Control 7","Continuous Vulnerability Management",25,{"family":5,"item":137,"code":138,"title":139,"together":140},"ac-3","AC-3","Access Enforcement",24]