Quick Wins for Better Website Security (Dan Callahan)

Learn quick and easy techniques to improve your website's security, protect against session hijacking, and defend against XSS and data injection attacks.

This talk will cover simple but lesser known techniques for dramatically improving your website's security, including:

This talk will explore:

1. HTTP Strict Transport Security (HSTS)
2. Content Security Policies (CSP)
3. Secure / HttpOnly cookies
4. XSS Protection
5. Frame Options
6. Isolated domains for user content
7. Avoiding passwords altogether

Transcript

1. QUICK WINS FOR BETTER WEBSITE SECURITY Dan Callahan dcallahan@mozilla.com dancallahan.info @callahad
2. THREE PARTS Transmitting Rendering Storing
3. TRANSMITTING
4. USE SSL
5. http://... Browser http://... Browser https://... https://...
6. http://... Browser http://... Browser https://... https://...
7. http://... Browser http://... Browser https://... https://...
8. http://... Browser http://... Browser https://... https://...
9. http://... Browser http://... Browser https://... https://...
10. http://... Browser http://... Browser https://... https://... Cookies Cookies
11. http://... Browser http://... Browser https://... https://... Attacker Attacker Cookies Cookies
12. http://... Browser http://... Browser https://... https://... Attacker Attacker Cookies Cookies
16. USE SECURE COOKIES
17. Set-Cookie: xs=984ea98f98a6a19c
18. Set-Cookie: xs=984ea98f98a6a19c; secure
19. http://... Browser http://... Browser https://... https://... Attacker Attacker Cookies Cookies
20. http://... Browser http://... Browser https://... https://... Attacker Attacker Cookies
21. http://... Browser http://... Browser https://... https://... Attacker Attacker Cookies
22. http://... Browser http://... Browser https://... https://... Attacker Attacker Cookies
24. https://www.bankofamerica.com http://bankofamerica.com http://www.bankofamerica.com
25. https://www.bank0famerica.com bank0famerica.com? http://bankofamerica.com http://www.bankofamerica.com
26. USE STRICT TRANSPORT SECURITY
29. Strict-Transport-Security: max-age=2592000
30. http://... Browser http://... Browser https://... https://... Attacker Attacker Cookies
31. http://... Browser http://... Browser https://... https://... Attacker Attacker Cookies
32. TRANSMIT RENDER STORE SSL Secure Cookies Strict Transport Security
33. RENDERING
34. Set-Cookie: xs=984ea98f98a6a19c; secure
35. Set-Cookie: xs=984ea98f98a6a19c; secure <script> alert(document.cookie); </script>
36. Set-Cookie: xs=984ea98f98a6a19c; secure <script> alert(document.cookie); </script> “xs=984ea98f98a6a19c”
37. USE HTTPONLY COOKIES
38. Set-Cookie: xs=984ea98f98a6a19c; secure <script> alert(document.cookie); </script> “xs=984ea98f98a6a19c”
39. Set-Cookie: xs=984ea98f98a6a19c; secure; HttpOnly <script> alert(document.cookie); </script> “xs=984ea98f98a6a19c”
40. Set-Cookie: xs=984ea98f98a6a19c; secure; HttpOnly <script> alert(document.cookie); </script> “”
41. USE XSS PROTECTION
42. X-XSS-Protection: 1; mode=block
43. USE A CONTENT SECURITY POLICY
44. Content-Security-Policy: default-src 'self'; img-src 'self' data:; script-src: 'self' https://api.example.com
45. Content-Security-Policy: default-src 'self'; img-src 'self' data:; script-src: 'self' https://api.example.com Content-Security-Policy-Report-Only: ...
46. TRANSMIT RENDER STORE SSL Secure Cookies Strict Transport Security HttpOnly Cookies XSS Protection Content Security Policy
47. SET FRAME OPTIONS
48. X-Frame-Options: DENY X-Frame-Options: SAMEORIGIN X-Frame-Options: ALLOW-FROM uri
49. TRANSMIT RENDER STORE SSL Secure Cookies Strict Transport Security HttpOnly Cookies XSS Protection Content Security Policy Frame Options
50. STORING
51. ISOLATE USER CONTENT
52. Not your main domain Not a subdomain github.io googleusercontent.com
53. DON’T USE PASSWORDS
55. SUMMARY
56. TRANSMIT RENDER STORE SSL Secure Cookies Strict Transport Security HttpOnly Cookies XSS Protection Content Security Policy Frame Options User Content Domain Don’t Store Passwords
57. TRANSMIT RENDER STORE SSL Secure Cookies Strict Transport Security HttpOnly Cookies XSS Protection Content Security Policy Frame Options User Content Domain
58. QUESTIONS? Dan Callahan dcallahan@mozilla.com dancallahan.info @callahad