Presentation tied to blog post found at thehairyj.github.com/websec Template: Slides Carnival

1. How does Academia fare
in the realm of Web
Security?

2. Literature Review

3. Cryptography Across Industry Sectors
Investigation into HTTPS and HTTP header
adoption across industry sectors
Used Alexa categories for identify industry sector
Prof. Bill Buchanan
OBE
Prof. Alan
Woodward
Scott Helme

4. Our Key Findings
HTTPS
Highest share of HTTPS
adoption is 81% in the
Adult industry section
News and Recreation share
lowest share at 8%
Cipher Suite
ECDHE RSA w/ AES256
GCM SHA384 is the most
popular across the majority
of industry sectors
Certificate Authority
COMODO, GoDaddy and
Symantic podium across all
industry sectors
Let’s Encrypt appears in
Top 10 for Adult and
Games
TLS Version
TLSv1.2 is the
overwhelmingly most used
version.
TLSv1.0 is most used in
Recreation
HTTP Headers
Highest share of HTTPS
adoption is 81% in the
Adult industry section
Web Server
Apache was the most
popular across all industry
sectors

5. Adult, Arts, Business, Computers,
Games, Health, Home, Kids and
Teens, News, Recreation, Reference,
Regional, Science, Shopping,
Society, Sports, World

6. Methodology

7. Ask a Friend
I manage to rope Lloyd into writing a
scanner
● Written in Go
● Available upon request
● May need some tweaks

8. Creating a List of Academic Institutions
3
College mergers!
Go through college
mergers which don’t
have their own sites
and add each of the
individual colleges
Raises total to 490
1
National Student
Survey provides 438
institutions across UK
2
Upon inspection of the
dataset numerous
Scottish, Welsh and
Northern Irish
institutions are not
included on the list.
Adding these raised
the total to 475

9. Results

10. Key Findings
HTTPS
Of the 490 sites, 438
responded
Out of these 438 sites only
303 had HTTPS redirects
Cipher Suite
TLS ECDHE RSA w/ AES
256 CBC SHA is the most
used cipher suite
There was 251 unknown
results
Certificate Authority
QuoVadis is the most
popular CA at 140 sites
Let’s Encrypt was 2nd most
popular at 51
TLS Version
TLS 1.2 is the most popular
TLS version at 292
10 sites are using TLS 1.0
HTTP Headers
Total 420 HTTP headers
across 438 websites
X-Frame-Options is the
most common at 133
Only 16 sites have CSPs
Web Server
Apache is by far the most
popular web server used at
171 sites
Followed by Nginx and then
Microsoft IIS

11. Thanks!
Any questions?
thehairyj.github.com/websec
@TheHairyJ
@LloydLabs
Template: SlidesCarnival