A little help improving your website's transport security

Ivan Ristic of Qualys blogged last year about a TLS Maturity Model, citing that “over time, … deploying TLS securely is getting more complicated, rather than less”.

The article goes on to describe five levels of maturity for a TLS implementation:

  1. Chaos
  2. Configuration
  3. Application Security
  4. Commitment
  5. Robust Security

At section.io we have reached level 4 for our own website and our management portal (Aperture) and we are working toward achieving level 5. The work required for us to achieve this now means our platform can help you improve the TLS maturity of your websites too.

By using section.io for your website, you immediately achieve Level 2 because our platform is handling the TLS protocol configuration which we maintain at a Qualys “Grade A” level.

This frees you to focus on the application-level changes required to achieve Level 3, eg ensuring you don’t have mixed-mode resources on your pages, that cookies use the httponly and secure attributes appropriately, and that your origin validates anti-CSRF tokens.

When you’re ready to switch your website to HTTPS-only and enable Strict Transport Security, section.io’s Varnish proxy can help you redirect all insecure HTTP requests to their HTTPS alternative and also inject the necessary HSTS response headers so browsers will use HTTPS for your site by default. This brings you to level 4.

HPKP fingerprint

Finally, to make level 5 just a little bit easier, the HTTPS configuration page in our Aperture management portal displays the public key fingerprint of your HTTPS certificate that you will need when adding Public Key Pinning response headers.

Blog Categories

Interested in articles about a specific topic? Click on a category to see all related content.

section.io Sign up

Want to get started improving your website performance, scalability, and security? Sign up for a 14 day free trial of section.io and see what we can do for you!

Get started