{"id":113,"date":"2012-06-15T09:22:35","date_gmt":"2012-06-15T17:22:35","guid":{"rendered":"http:\/\/unmitigatedrisk.com\/?p=113"},"modified":"2012-06-16T16:35:30","modified_gmt":"2012-06-17T00:35:30","slug":"whats-your-organizations-policy-on-ssl","status":"publish","type":"post","link":"https:\/\/unmitigatedrisk.com\/?p=113","title":{"rendered":"What is your organizations policy on SSL?"},"content":{"rendered":"

In other posts\u00a0I discussed how to redirect the initial request to a website from the HTTP version to the HTTPS \u00a0(for\u00a0Apache<\/a>\u00a0and\u00a0IIS<\/a>).<\/p>\n

By following those steps your website no longer will serve HTTP content but users will still be able to get to your site without having to know to type the HTTPS:\\\\ before they browse to your site.<\/p>\n

This is an important part of making your site reachable by users over SSL because:<\/p>\n

    \n
  1. Most users do not type a URL moniker at all when entering an URL.<\/li>\n
  2. Since 99% of the traffic on the Internet is not available over HTTPS so browsers default to HTTP.<\/li>\n
  3. Existing HTTP URLs that have been indexed by search engines, embedded in documents, passed off in emails can continue to work.<\/li>\n<\/ol>\n

    This approach isn’t perfect, for example:<\/p>\n

      \n
    1. An attacker can perform a Man-In-The-Middle on the initial request and bypass the SSL protection (see sslstrip<\/a>).<\/li>\n
    2. It has the potential to \u201ctrain users\u201d to not navigate to the HTTPs version of your site initially.<\/li>\n<\/ol>\n

      The problem is of course that the alternative of returning an error when a user requests the HTTP version of the website (say a 403.4 \u2013 SSL required<\/a>) or simply not having a server listening on the HTTP port is almost the same as saying your site isn\u2019t accessible to the mainstream users.<\/p>\n

      So how can you manage these problems? There are a few things you can do:<\/p>\n

      For sensitive services like those for login and those that collect personal information or credit cards actually use 403.4 errors<\/a>. This tells the user in no uncertain terms that SSL is required for that task but since the browsing experience does not typically \u201cstart here\u201d you do break the user experience for your users.<\/p>\n

      You may also want to consider hosting the most sensitive content like login and account details on a separate virtual host that does not have a HTTP listener (for example login.example.com or accounts.example.com).<\/p>\n

      Next you should communicate your policy on SSL to the web browsers so they can do the right thing for the users, there are several ways for you to do this:<\/p>\n

        \n
      1. Set the HTTP Strict-Transport-Security<\/a> (HSTS) header for your pages this will tell the browsers to require SSL on your site.<\/li>\n
      2. Request that your site be added to the\u00a0HTTPS Everywhere Rule list<\/a>.<\/li>\n
      3. Request that your site be added to the Preloaded HSTS list<\/a> in Google Chrome.<\/li>\n
      4. If you are a larger site you can also request that Google \u201cpin\u201d your web server\u2019s public keys to your domain<\/a>.<\/li>\n<\/ol>\n

        These things will not eliminate these risks but it does help, especially for those using browsers that support HSTS (Chrome and Firefox as of today) or those that are using plugins like HTTPS Everywhere<\/a> and NoScript<\/a>.<\/p>\n

        As for the last two, they are clearly Chrome specific but it represents about 32% of the browser market today<\/a> and as such is worth paying attention to.<\/p>\n

        Ryan<\/p>\n

        <\/h5>\n
        Additional Resources<\/h6>\n

        How to Deploy HTTPS Correctly<\/a><\/p>\n

         <\/p>\n","protected":false},"excerpt":{"rendered":"

        In other posts\u00a0I discussed how to redirect the initial request to a website from the HTTP version to the HTTPS \u00a0(for\u00a0Apache\u00a0and\u00a0IIS). By following those steps your website no longer will serve HTTP content but users will still be able to get to your site without having to know to type the HTTPS:\\\\ before they browse […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[3,4],"tags":[31,33,168,6],"class_list":["post-113","post","type-post","status-publish","format-standard","hentry","category-security","category-thoughts","tag-apache","tag-iis","tag-security","tag-ssl"],"_links":{"self":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts\/113","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=113"}],"version-history":[{"count":0,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts\/113\/revisions"}],"wp:attachment":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=113"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=113"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=113"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}