This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Transport Layer Protection Cheat Sheet"

From OWASP
Jump to: navigation, search
m
(wrote skeleton of document)
Line 5: Line 5:
 
== Benefits  ==
 
== Benefits  ==
  
−
Confidentiality  
+
*Confidentiality  
 +
*Integrity
 +
*Replay Protection
 +
*End Point Authentication
  
−
Integrity
+
= Rules for Transport Layer Protection<br>  =
  
−
Replay Protection
+
== Secure Server Design <br>  ==
  
−
End Point Authentication
+
=== Rule - Use SSL for All Login Pages and All Authenticated Pages<br>  ===
  
−
= Rules for Transport Layer Protection<br>  =
+
=== Rule - Use SSL on Any Networks (External and Internal) Transmiting Sensitive Data<br>  ===
 +
 
 +
=== Rule - Do Not Provide Non-SSL Pages for Secure Content<br>  ===
 +
 
 +
=== Rule - Do Not Perform Redirects from Non-SSL Page to&nbsp;SSL&nbsp;Login Page  ===
  
−
== Secure Server Design <br> ==
+
=== Rule - Do Not Mix SSL and Non-SSL&nbsp;Content ===
  
−
=== Rule #1 - Use SSL for All Login Pages and All Authenticated Pages<br>  ===
+
=== Rule - Use "Secure" Cookie Flag ===
  
−
=== Rule #2 - Use SSL on Any Networks (External and Internal) Transmiting Sensitive Data<br>  ===
 
  
−
=== Rule #3 - Do Not Provide Non-SSL Pages for Secure Content<br>  ===
 
  
−
=== Rule #4 - Do Not Perform Redirectsfrom Non-SSL Login to&nbsp;SSL&nbsp;Login Page ===
+
== Server Certificate &amp;&nbsp;Protocol Configuration ==
  
−
=== Rule #5 - Do Not Mix SSL and Non-SSL&nbsp;Content ===
+
=== Rule - Use an Appropriate Certificate Authority for the Application's User Base ===
  
 +
=== Rule - Only Support Strong Cryptographic Algorithms<br>  ===
  
 +
=== Rule - Only Support Strong Protocols  ===
  
−
== Server Certificate &amp;&nbsp;Protocol Configuration ==
+
=== Rule - Establish a Strong Private Key for the Server  ===
  
−
=== Rule #6 - Use an Appropriate Certificate Authority for the Application's User Base ===
+
=== Rule - Use a Certificate That Supports All Available Domain Names<br>  ===
  
−
=== Rule #7 - Only Support Strong Cryptographic Algorithms<br>  ===
 
  
−
=== Rule #8 - Only Support Strong Protocols  ===
 
  
−
=== Rule #9 - Establish a Strong Private Key for the Server ===
+
== Client Configuration  ==
  
−
=== Rule #10 - Use a Certificate That Supports All Available Domain Names<br> ===
+
=== Rule - Validate the Server's Certificate<br> ===
  
 +
=== Rule - Perform Certificate Revocatoin List Checking<br> ===
  
 +
=== Rule - Ensure the Trusted Root Store Contains Only Trusted Entries<br> ===
  
 +
=== Rule - Deny Connections if Any SSL&nbsp;Related Errors are Encountered<br> ===
  
  
−
== Client Configuration  ==
 
  
−
Certificate Validation
+
== Additional Controls  ==
  
−
Trusted Root Store
+
=== Extended Validation Certificates<br> ===
  
−
Revocation List Checking
+
=== Client Side Certificates ===
  
−
== Additional Controls ==
+
===  ===

Revision as of 02:20, 6 October 2009

Page is under contruction - [email protected]

Introduction

Benefits

  • Confidentiality
  • Integrity
  • Replay Protection
  • End Point Authentication

Rules for Transport Layer Protection

Secure Server Design

Rule - Use SSL for All Login Pages and All Authenticated Pages

Rule - Use SSL on Any Networks (External and Internal) Transmiting Sensitive Data

Rule - Do Not Provide Non-SSL Pages for Secure Content

Rule - Do Not Perform Redirects from Non-SSL Page to SSL Login Page

Rule - Do Not Mix SSL and Non-SSL Content

Rule - Use "Secure" Cookie Flag

Server Certificate & Protocol Configuration

Rule - Use an Appropriate Certificate Authority for the Application's User Base

Rule - Only Support Strong Cryptographic Algorithms

Rule - Only Support Strong Protocols

Rule - Establish a Strong Private Key for the Server

Rule - Use a Certificate That Supports All Available Domain Names

Client Configuration

Rule - Validate the Server's Certificate

Rule - Perform Certificate Revocatoin List Checking

Rule - Ensure the Trusted Root Store Contains Only Trusted Entries

Rule - Deny Connections if Any SSL Related Errors are Encountered

Additional Controls

Extended Validation Certificates

Client Side Certificates

Retrieved from "https://wiki.owasp.org/index.php?title=Transport_Layer_Protection_Cheat_Sheet&oldid=70775"