Ivan Ristic of Qualys blogged last year about a TLS Maturity Model, citing that “over time, … deploying TLS securely is getting more complicated, rather than less”.
The article goes on to describe five levels of maturity for a TLS implementation:
- Chaos
- Configuration
- Application Security
- Commitment
- Robust Security
At Section we have reached level 4 for our own website and our management portal (Section Console) and we are working toward achieving level 5. The work required for us to achieve this now means our platform can help you improve the TLS maturity of your websites too.
By using Section for your website, you immediately achieve Level 2 because our platform is handling the TLS protocol configuration which we maintain at a Qualys “Grade A” level.
This frees you to focus on the application-level changes required to achieve Level 3, eg ensuring you don’t have mixed-mode resources on your pages, that cookies use the httponly and secure attributes appropriately, and that your origin validates anti-CSRF tokens.
When you’re ready to switch your website to HTTPS-only and enable Strict Transport Security, Section’s Varnish Cache proxy can help you redirect all insecure HTTP requests to their HTTPS alternative and also inject the necessary HSTS response headers so browsers will use HTTPS for your site by default. This brings you to level 4.
Finally, to make level 5 just a little bit easier, the HTTPS configuration page in our Section Console displays the public key fingerprint of your HTTPS certificate that you will need when adding Public Key Pinning response headers.
