Over a million developers have joined DZone.
{{announcement.body}}
{{announcement.title}}

A Little Help Improving Your Website's Transport Security

DZone's Guide to

A Little Help Improving Your Website's Transport Security

Ivan Ristic of Qualys blogged last year about a TLS Maturity Model, citing that “over time, … deploying TLS securely is getting more complicated, rather than less”.

· Web Dev Zone ·
Free Resource

Learn how error monitoring with Sentry closes the gap between the product team and your customers. With Sentry, you can focus on what you do best: building and scaling software that makes your users’ lives better.

Ivan Ristic of Qualys blogged last year about a TLS Maturity Model, citing that “over time, … deploying TLS securely is getting more complicated, rather than less”.

The article goes on to describe five levels of maturity for a TLS implementation:

  1. Chaos
  2. Configuration
  3. Application Security
  4. Commitment
  5. Robust Security

At section.io we have reached level 4 for our own website and our management portal (Aperture) and we are working toward achieving level 5. The work required for us to achieve this now means our platform can help you improve the TLS maturity of your websites too.

By using section.io for your website, you immediately achieve Level 2 because our platform is handling the TLS protocol configuration which we maintain at a Qualys “Grade A” level.

This frees you to focus on the application-level changes required to achieve Level 3, eg ensuring you don’t have mixed-mode resources on your pages, that cookies use the httponly and secure attributes appropriately, and that your origin validates anti-CSRF tokens.

When you’re ready to switch your website to HTTPS-only and enable Strict Transport Security, section.io’s Varnish proxy can help you redirect all insecure HTTP requests to their HTTPS alternative and also inject the necessary HSTS response headers so browsers will use HTTPS for your site by default. This brings you to level 4.

HPKP fingerprint

Finally, to make level 5 just a little bit easier, the HTTPS configuration page in our Aperture management portal displays the public key fingerprint of your HTTPS certificate that you will need when adding Public Key Pinning response headers.

What’s the best way to boost the efficiency of your product team and ship with confidence? Check out this ebook to learn how Sentry's real-time error monitoring helps developers stay in their workflow to fix bugs before the user even knows there’s a problem.

Topics:
implementation ,requests ,hsts ,security ,https ,tls ,portal ,transport

Published at DZone with permission of

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}