Secure Sockets Layer (SSL) configuration is a critical component of defending publicly accessible web applications against man-in-the-middle attacks. This is the first of a three-part series on SSL configuration best practices. We’ll start with SSL secure server design.
Why Do You Need SSL?
For businesses with an e-commerce site or a site that collects or transmits client data––particularly sensitive data––SSL is essential to ensure that data isn’t available to a third party for malicious purposes. In addition, Google uses SSL certificates for ranking and has hinted that SSL certificates might become a requirement for their search results.
Poor SSL management can have dire consequences:
- Costly service disruptions. For example, in February 2013, Microsoft pushed the release of a TLS certificate update that was past the currently deployed TLS certificate expiration date. This scenario resulted in a major disruption, and Microsoft was forced to refund customers for the service outage, which included Xbox Live.
- An impact on embedded devices. In December 2014, Hypercom credit card terminals stopped working during the busy holiday retail season as a result of an expired certificate. Needless to say, the error was costly for retailers and the device manufacturer alike.
- Rogue certificates. Rogue certificates allow attackers to create false sites that are practically indistinguishable from the original site. Attackers can then gain access to user information for malicious purposes. In an extreme case, a security breach at a certificate authority resulted in the issuance of more than 500 rogue certificates, resulting in a cascade of man-in-the-middle and phishing attacks.
SSL Secure Server Best Practices
As the Open Web Application Security Project (OWASP) warns, “Although the concept of SSL is known to many, the actual details and security-specific decisions of implementation are often poorly understood and frequently result in insecure deployments.” To avoid this outcome, follow best practices in your SSL implementation and secure server design.
OWASP provides a useful overview of SSL secure server design rules and best practices, including:
- Use TLS (the successor to SSL) or other strong transport everywhere
- Do not provide non-TLS pages for secure content
- Do not mix TLS and non-TLS content
- Use “secure” cookie flag
- Keep sensitive data out of the URL
- Prevent caching of sensitive data
- Use HTTP strict transport security
- Use public key pinning
Safeguard with SSL
SSL is a necessary protection in the ever-increasingly risky web environment. Proper secure server design is the first step in safeguarding your web applications. Stay tuned for part two next month as we dive in to SSL Configuration Best Practices for Server Certificates.