TLS 1.0 in SSL VPN. Is it high time to write it off?

[Ivanleonel]

Hi!

What do you think about TLS 1.0 using in SSL VPN on cisco ASA?
Notably I’m using DTLS 1.0 with RSA_AES_128_SHA1 cipher and SHA2 certificates.

I Have a bunch old ASA 5505 which don’t support TLS 1.1/1.2 so I wonder:
1) How bad is to use TLS 1.0 in SSL VPN nowadays? As far as I understand BEAST is not simple way to implement isn’t?
2) Is there only one major security risk with TLS 1.0 (BEAST)?

Thanks!

[rvarelac]

Hi Ivan, 

From the security perspective is higly recommeded to have the network devices using the most secure protocols available, as you mention unfortunately the ASA5505 does not support TLS1.2 due to the hardware limitation. 

Implement a BEAST attack is extremely complex and have a low chance of sucess, however there is always the possibilit that someone can exploit this vulnerabiliy.

I found the following forum intersting, I hope it clears your doubts about BEAST and TLSv1.0 vulnerabilities.

https://community.qualys.com/blogs/securitylabs/2013/09/10/is-beast-still-a-threat

Hope it helps.

-Randy-