Revision as of 22:00, 7 October 2009

Page is under contruction - [email protected]

Introduction

Benefits

• Confidentiality
• Integrity
• Replay Protection
• End Point Authentication

Rules for VPN

Rules for SSL/TLS

Secure Server Design

Rule - Use SSL for All Login Pages and All Authenticated Pages

Rule - Use SSL on Any Networks (External and Internal) Transmiting Sensitive Data

Rule - Do Not Provide Non-SSL Pages for Secure Content

Rule - Do Not Perform Redirects from Non-SSL Page to SSL Login Page

Rule - Do Not Mix SSL and Non-SSL Content

Rule - Use "Secure" Cookie Flag

Server Certificate & Protocol Configuration

Rule - Use an Appropriate Certificate Authority for the Application's User Base

Rule - Only Support Strong Cryptographic Algorithms

Rule - Only Support Strong Protocols

Rule - Establish a Strong Private Key for the Server

Rule - Use a Certificate That Supports All Available Domain Names

Client Configuration

Rule - Validate the Server's Certificate

Rule - Perform Certificate Revocatoin List Checking

Rule - Ensure the Trusted Root Store Contains Only Trusted Entries

Rule - Deny Connections if Any SSL Related Errors are Encountered

Additional Controls

Extended Validation Certificates

Client Side Certificates