Difference between revisions of "Web Site Security"

Revision as of 18:07, 17 July 2020

This page is about the means to make sure that your web site is as secure as it can be.

For information about the user perspective see the wiki page User Trust of a Web Site.

There are a number of web platforms, more it seems every day, like Apache, ASP.NET, JSP etc.
But there is also a large commonality, like the security protocol HTTPS which is well over 90% penetration of all sites, mostly due to Google's insistence.
Nearly all of the web platforms run on Windows or Linux, typically hosted by one of the major providers, like Amazon or Microsoft, which have global reach.
Cloud Flare and others provide security support at the edge, like protection from Denial of Service (DoS) attacks.
Akamai and many other provider content delivery platforms.
This page will focus on the parts that are typically under control of the web app architectural and development teams.

Businesses hire programmers that can deliver business solutions on the web. Security of the web site is never the first consideration, and there is plenty of evidence that it isn't fully funded until after the site has gone live and been attacked.

These are proposed on 2019-05-08 for a future release:

The Web Site exposes its name in a manner that allows the user to make a meaningful trust decision. See the page on Trusted Identifier and Web Site Identity for details.
Most browsers come with a feature that will evaluate any file downloaded to a computer based on a set of constantly updated filters installed in the cloud.

The Open Web Application Security Project (OWASP) is a 501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of web site software.
ISACs are member-driven organizations, delivering all-hazards threat and mitigation information to asset owners and operators.

@@ Line 19: / Line 19: @@
 ==Problems==
 * Businesses hire programmers that can deliver business solutions on the web. Security of the web site is never the first consideration, and there is plenty of evidence that it isn't fully funded until after the site has gone live and been attacked.
-* Secure Web Sites using SSL (HTTPS:// scheme) still allow insecure content to be loaded. On 2017-10-27 it was [https://github.com/mikewest/webappsec-mixed-content/blob/master/proposed-level-2-roadmap.md estimated that 2.4% of sites downloaded secure content]. On 2019-05-08 Chrome browser (currently version 74) was just announcing (on blink-dev) that they finally intend "to block insecurely-delivered downloads initiated from secure contexts if the download is for a high-risk file type", in spite of its appearance as section 4.6.5 of [https://html.spec.whatwg.org/#downloading-resources the current html spec.] Which asserts: '''Warning! This algorithm is intended to mitigate security dangers involved in downloading files from untrusted sites, and user agents are strongly urged to follow it.''' It is unclear which version of Chrome might have this feature.
+*
 ==Solutions==