This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Periodic Table of Vulnerabilities - Insufficient Transport Layer Protection"

From OWASP
Jump to: navigation, search
m
Line 2: Line 2:
  
 
=== Root Cause Summary ===
 
=== Root Cause Summary ===
−
<summary here>
+
Not all traffic flowing between two endpoints is properly secured, which makes it possible for attackers to perform man-in-the-middle attacks.
  
 
=== Browser / Standards Solution ===
 
=== Browser / Standards Solution ===
−
<browser/standards solutions here>
+
Implement HTTP Strict Transport Security in all browsers, which makes it possible to better enforce secure connections.
 +
Fix DNS and browser technologies so that the intent of domain owners can be more strictly followed.
  
 
=== Perimeter Solution ===
 
=== Perimeter Solution ===
−
<perimeter solutions here>
+
* Make sure that SSL is properly configured on the server:
 +
** Disable all weak SSL/TLS protocols (such as SSLv2)
 +
** Disable all weak 'export' algorithms (such as DES, RC4-40, DHE-RSA-Export)
 +
** Make sure that the minimum session key size is 128 bits
 +
** Use a SSL certificate with a minimum key size of 1024 bits
 +
** Do not offer MD5 as cryptographic hash algorithm
 +
** Disable Anonymous Diffie-Hellman key establishment
 +
* Enforce HTTP Strict Transport Security (HSTS)
 +
* Redirect all HTTP request to HTTPS
  
−
Complexity: High/Medium/Low<br>
+
Complexity: Low<br>
−
Impact: High/Medium/Low
+
Impact: High
  
 
=== Generic Framework Solution ===
 
=== Generic Framework Solution ===
−
<generic framework solutions here>
+
None
−
 
 
−
Complexity: High/Medium/Low<br>
 
−
Impact: High/Medium/Low
 
  
 
=== Custom Framework Solution ===
 
=== Custom Framework Solution ===
−
<custom framework solutions here>
+
None
−
 
 
−
Complexity: High/Medium/Low<br>
 
−
Impact: High/Medium/Low
 
  
 
=== Custom Code Solution ===
 
=== Custom Code Solution ===
−
<custom code solutions here>
+
None
−
 
 
−
Complexity: High/Medium/Low<br>
 
−
Impact: High/Medium/Low
 
  
 
=== Discussion / Controversy ===
 
=== Discussion / Controversy ===
−
<discussion / controversy tracking here>
+
HTTP Strict Transport Security is at the entry-level maturity, a proposed standard. Not all browsers implement it (yet). <br>
 +
The security of ciphers changes over time, so it's important to periodically review whether certain ciphers and minimum key sizes are still considered safe enough.
  
 
=== References ===
 
=== References ===
−
<references here>
+
[https://www.owasp.org/index.php/Top_10_2010-A9-Insufficient_Transport_Layer_Protection Insufficient Transport Layer Protection (OWASP)]<br>
 +
[http://projects.webappsec.org/w/page/13246945/Insufficient%20Transport%20Layer%20Protection Insufficient Transport Layer Protection (WASC TC)]<br>
 +
[http://csrc.nist.gov/publications/nistpubs/800-52/SP800-52.pdf Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations (NIST SP 800-52)]
 +
[http://tools.ietf.org/html/rfc6797 HTTP Strict Transport Security (IETF)]

Revision as of 00:53, 14 May 2013

Insufficient Transport Layer Protection

Root Cause Summary

Not all traffic flowing between two endpoints is properly secured, which makes it possible for attackers to perform man-in-the-middle attacks.

Browser / Standards Solution

Implement HTTP Strict Transport Security in all browsers, which makes it possible to better enforce secure connections. Fix DNS and browser technologies so that the intent of domain owners can be more strictly followed.

Perimeter Solution

  • Make sure that SSL is properly configured on the server:
    • Disable all weak SSL/TLS protocols (such as SSLv2)
    • Disable all weak 'export' algorithms (such as DES, RC4-40, DHE-RSA-Export)
    • Make sure that the minimum session key size is 128 bits
    • Use a SSL certificate with a minimum key size of 1024 bits
    • Do not offer MD5 as cryptographic hash algorithm
    • Disable Anonymous Diffie-Hellman key establishment
  • Enforce HTTP Strict Transport Security (HSTS)
  • Redirect all HTTP request to HTTPS

Complexity: Low
Impact: High

Generic Framework Solution

None

Custom Framework Solution

None

Custom Code Solution

None

Discussion / Controversy

HTTP Strict Transport Security is at the entry-level maturity, a proposed standard. Not all browsers implement it (yet).
The security of ciphers changes over time, so it's important to periodically review whether certain ciphers and minimum key sizes are still considered safe enough.

References

Insufficient Transport Layer Protection (OWASP)
Insufficient Transport Layer Protection (WASC TC)
Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations (NIST SP 800-52) HTTP Strict Transport Security (IETF)

Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Periodic_Table_of_Vulnerabilities_-_Insufficient_Transport_Layer_Protection&oldid=151516"