Failure to provide data transfers over encrypted and secured channels which would exclude the possibility of data leakage.

• Failure to enforce mechanisms limiting the leak surface, e.g., allowing the inference of any user data out of the mechanics of Web application operation.

1. What are the policies for protecting data in transit?

2. Is data encrypted during transfer?

3. Are secure protocols and algorithms used?

4. Are privacy-friendly protocols available for transfer?

5. Are private protocols enforced where appropriate (e.g., login is only available over HTTPS, and sensitive records only accessible by TLS or SFTP)?

1. Always send personal data by secure protocols, i.e., not an insecure protocol like ordinary email, many instant messaging clients, FTP.

2. Configure transfer protocols so they are secure enough for the types of data being transmitted.

3. Allow connections using the best available secure protocols, where possible.

4. Disallow weak protocols for sensitive information.

5. Avoid personal information in the URL, especially if the data transfer is unencrypted.

6. Activate privacy in protocols (e.g. Privacy Extensions in IPv6).

7. Support TLS/DTLS, do not support SSLv3.

8. Use ECDHE and GCM ciphers, do not support static RSA key exchange and CBCbased ciphers.

1. Configure services to disable broken security protocols such as SSLv3.

2. Configure services to enable the latest secure protocols.

3. Enforce HTTPS for the entire Web application session, from first visit to login page to completion of logout.

4. Disable vulnerable file transfer services such as Telnet and FTP on file servers. Enable secure transfer protocols instead.

5. About the insecurity of current internet technologies and the initiative to build new ones: see You Broke the Internet.org

• Guidance for implementors of HTTPS-only sites (Server side)

• It's time to turn on HTTPS: The benefits are well worth the effort

• Privacy Extensions in IPv6

• Background information: IEEE 802 Tutorial about Designing Privacy into Internet Protocols (July 2014)