# Ensure Classic Load Balancer is Configured with Defensive or Strictest Desync Mitigation Mode - Source: https://support.icompaas.com/support/solutions/articles/62000233337-ensure-classic-load-balancer-is-configured-with-defensive-or-strictest-desync-mitigation-mode - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Profile Applicability:** - ****Level 2**** ### ****Description:**** The Classic Load Balancer (CLB) in AWS should be configured with the defensive or strictest desync mitigation mode to protect against desynchronization (desync) attacks. Desync attacks occur when inconsistencies arise between the interpretation of HTTP requests by the load balancer and backend servers, potentially allowing malicious actors to bypass security measures or exploit backend systems. **Desync mitigation modes available:** - monitor: Observes traffic but does not block potentially desynced requests. - defensive (recommended): Actively blocks suspicious traffic to prevent desync attacks. - strictest: Blocks all requests that might be desynced, even if legitimate. ### **Rationale:** **Setting defensive or strictest desync mitigation mode helps:** - Prevent Desync Attacks: Protects against malformed or split HTTP requests that can bypass security checks. - Enhance Security Posture: Reduces risks of request smuggling and related vulnerabilities. - Compliance: Aligns with security best practices and standards for web application security. ### **Impact** - **Pros:** - Enhanced protection against HTTP desync attacks. - Reduced risk of security breaches due to maliciously crafted HTTP requests. - **Cons**: - The strictest mode may block some legitimate requests if not properly tested. - Possible performance overhead due to additional request validation. ### **Default Value:** - By default, Classic Load Balancer is set to monitor mode, which does not block desync attempts but logs them. ### **Pre-Requisite:** - **IAM Permissions: ** - elasticloadbalancing:DescribeLoadBalancers - elasticloadbalancing:ModifyLoadBalancerAttributes - AWS CLI installed and configured. ##### **Remediation:** **TestPlan:** ##### **Using AWS Console:** 1. Sign in to the [AWS Management Console](https://console.aws.amazon.com/). 2. Navigate to EC2 Dashboard → Load Balancers. ![](https://support.icompaas.com/assets/kb/c687cb91888dff22.png) 3. Select the Classic Load Balancer you want to review. ![](https://support.icompaas.com/assets/kb/7184f741fa99a488.png) 4. Go to the Description tab and click Edit attributes. ![](https://support.icompaas.com/assets/kb/d6e5d364dbff01d3.png) 5. Review the Desync Mitigation Mode setting. - Pass: If set to defensive or strictest. - Fail: If set to monitor. ![](https://support.icompaas.com/assets/kb/7e5a5065a5d69e24.png) ##### **Using AWS CLI:** **List Classic Load Balancers:** aws elb describe-load-balancers --region --query 'LoadBalancerDescriptions\[\*\].\[LoadBalancerName\]' **Check Desync Mitigation Mode for Each CLB:** aws elb describe-load-balancer-attributes --load-balancer-name --region --query 'LoadBalancerAttributes.DesyncMitigationMode' **Expected Output (Pass):** "defensive" or "strictest" Fail Output: "monitor" ### **Implementation Steps:** #### **Using AWS Console:** 1. Sign in to the [AWS Console](https://console.aws.amazon.com/). 2. Navigate to EC2 Dashboard → Load Balancers. 3. Select the Classic Load Balancer to modify. 4. In the Description tab, click Edit attributes. 5. Locate the Desync Mitigation Mode setting. ![](https://support.icompaas.com/assets/kb/681d9dd793a9e692.png) 6. Select defensive or strictest from the dropdown. ![](https://support.icompaas.com/assets/kb/dedf55283d62df9f.png) 7. Click Save to apply the changes. ![](https://support.icompaas.com/assets/kb/5bb71f59f10a3995.png) #### **Using AWS CLI:** **Set Desync Mitigation Mode to Defensive:** aws elb modify-load-balancer-attributes --load-balancer-name \\ --load-balancer-attributes '{"DesyncMitigationMode":"defensive"}' --region **OR Set to Strictest (if required):** aws elb modify-load-balancer-attributes --load-balancer-name \\ --load-balancer-attributes '{"DesyncMitigationMode":"strictest"}' --region **Verify Changes:** aws elb describe-load-balancer-attributes --load-balancer-name --region --query 'LoadBalancerAttributes.DesyncMitigationMode' ### **Backout Plan:** If enabling defensive or strictest mode causes issues with legitimate traffic: **Using AWS Console:** - Navigate to EC2 Dashboard → Load Balancers. - Select the affected Classic Load Balancer. ![](https://support.icompaas.com/assets/kb/8d150268b37c8c23.png) - In Edit attributes, revert the Desync Mitigation Mode back to monitor. ![](https://support.icompaas.com/assets/kb/9f9e2cf1380cfd30.png) **Using AWS CLI:** aws elb modify-load-balancer-attributes --load-balancer-name \\ --load-balancer-attributes '{"DesyncMitigationMode":"monitor"}' --region ### **References:** 1. [AWS Desync Mitigation Mode Documentation](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/classic-load-balancer-desync.html) 2. [AWS CLI - Modify Load Balancer Attributes](https://docs.aws.amazon.com/cli/latest/reference/elb/modify-load-balancer-attributes.html) 3. [OWASP Request Smuggling Guide](https://owasp.org/www-community/attacks/HTTP_Request_Smuggling) ### **CIS Controls:** ###

Version	Control ID	Control Description	IG1	IG2	IG3
v8	9.2	Ensure Proper Network Segmentation – Implement network security controls to segment and protect sensitive systems.	●	●	●
v8	13.6	Implement Application Layer Filtering – Apply security measures to filter malicious traffic at the application layer.	●	●	●
v7	9.2	Limit and Control Network Ports, Protocols, and Services – Apply filtering and monitoring to protect network services.	●	●	●

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.