1. Website Security 101
Per Thorsheim
Twitter: @thorsheim

3. Quick basic tests

7. DNS – DNSSEC
• .UA root was signed on April 13, 2012
• https://en.wikipedia.org/wiki/.ua

8. Testing HTTPS configuration

10. Testing email security (STARTTLS)

12. Testing Website Security Headers

14. X-Content-Type-Options
Reduce risk of clientbrowser downloading malware from your server.
Configuration:
X-Content-Type-Options: nosniff

15. X-Xss-Protection
Tells visiting web browsers how to handle input weaknesses in how
webpages handles input. This reduces the risk of phishing and session
hijacking.
Best configuration:
X-XSS-Protection: 1; mode=block

16. X-Frame-Options
Tell browsers that your website CAN NOT be displayed inside another
«frame» on a webpage, effectively reducing the risk of phishing attacks.
Example configuration:
add_header X-Frame-Options "SAMEORIGIN" always;

17. HSTS (Strict Transport Security) – RFC 6797
HSTS tells visiting web browsers to always use HTTPS when connecting
to the website, for N period of time.
This only works for websites that offers HTTPS.

18. HPKP (Public Key Pinning) – RFC 7469
HPKP goes one step further compared to HSTS, by adding your website
to a preloaded list in web browsers, telling them to use HTTPS even the
first time they connect to a website. Additionally HPKP tells browsers
which certificates to expect at all sites using HPKP.
This will very effectively block most MitM attacks, but requires good
technical knowledge to implement and maintain.

19. CSP – Content Security Policy
A CSP is a set of rules that a website sends to a visiting client browser,
telling the browser which external sites that are allowed to serve
content for the web page.
A lot of companies does MitM of plaintext HTTP traffic, in order to
inject or replace ads and other information for the end user. CSP will
prevent this from happening. However HTTPS should be used to
protect the CSP itself from MitM attacks.

20. Without Content Security Policy
Online newspaper
Adserver
Evil server

21. With Content Security Policy
Online newspaper
Adserver
CSP
Evil server

22. Real-world applicability
Newspapers in Ukraine

24. Speed (usability)

25. http://www.http2demo.io/

30. per@thorsheim.net
+47 90 99 92 59 (Signal, Whatsapp)
@thorsheim
QUESTIONS?