Man-in-the-Middle Attack
What is Man-in-the-Middle Attack?
An attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. MITM attacks can intercept sensitive data such as login credentials and financial information.
Frameworks that govern man-in-the-middle attack
What the standards actually require on man-in-the-middle attack
Requirements naming man-in-the-middle attack across 3 standards, quoted from the control text.
The IACS shall provide the capability to protect the integrity of sessions, defending against hijack, replay and man-in-the-middle attacks, particularly for operator and engineering sessions.
62443-3-3-FR3-SR-3-8 · Session Integrity →Per OWASP ASVS V9: implement secure communications. Requirements include (a) use TLS 1.2 or later with strong cipher suites + appropriate key sizes for all sensitive communications + (b) implement HSTS + appropriate certificate validation + pinning where appli...
OWASPASVS-9 · Communication Security (V9) →Per OWASP MASVS v2 MASVS-NETWORK: secure network communication for mobile apps. Requirements include (a) use TLS 1.2 or later with strong cipher suites for all sensitive network communications + (b) implement certificate pinning where appropriate + with secure...
OWASPMASVS-4 · MASVS-NETWORK: Network Communication →Questions people ask about man-in-the-middle attack
What is Man-in-the-Middle Attack?
Why is Man-in-the-Middle Attack important for compliance?
Which compliance frameworks address Man-in-the-Middle Attack?
Where can I learn more about Man-in-the-Middle Attack?
See how Man-in-the-Middle Attack applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.