www.bancroft.berkeley.edu

Why it matters

TLS 1.0 and TLS 1.1 use outdated security designs and are no longer accepted by modern standards. Leaving them enabled allows older, weaker connection methods.

What to do

Disable TLS 1.0 and TLS 1.1, support TLS 1.2 securely, and enable TLS 1.3 where possible.

Evidence and check scope

Supported TLS versions:

TLS 1.0, TLS 1.1, TLS 1.2

TLS version test outcomes:

TLS 1.0: Accepted, TLS 1.1: Accepted, TLS 1.2: Accepted, TLS 1.3: Rejected

Host requested:

www.bancroft.berkeley.edu

Resolved IPs tested:

128.32.10.252

IP that returned the observed result:

128.32.10.252

References

Why it matters

Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.

What to do

Define only the sources the application needs, test the policy before activating it, and avoid broad wildcard (*) rules, unsafe-inline, and unsafe-eval where possible.

Why it matters

Names containing admin, development, staging, VPN, database, or monitoring terms may point attackers toward valuable systems. A name alone does not prove exposure, but it identifies a surface that should be reviewed.

What to do

Remove obsolete DNS names and protect non-public systems with strong authentication, MFA, network allowlists, or a VPN.