Collaborate Disseminate
Is there a guide or checklist for a security audit of a website in, but not limited to following areas?
HTTP/HTTP2/HTTP3
Web sockets
XSS
Access Control Headers
Server/Database
DDOS Attack
SSL
…
…
Continue reading Guide, Checklist, or Tools for Security Audit for a Website [on hold]
I am working on project which has more focus on user data security. Public key cryptography is being used in this and private key is getting stored to user device locally (computer local file system). This private key is requ… Continue reading Accessing a permitted file from local file system securely
I have a website to do security testing. The CSP is as follows.
default-src * ;
style-src ‘self’ ‘unsafe-inline’ data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws.com/ ;
script-src ‘self’ ‘… Continue reading Is using default-src * safe?
I’m new here, and sorry if my english is a little bit broken it’s not my main language.
I’m trying to put together a document/ppt for my startup with a Zero Day policy structure.
But I’m not finding real implemented flows, … Continue reading Zero Day Policies implementation
I am scheduled to be part of a team to assess SOC (Security Operations Center) Solution vendors in order to determine the best Solution to purchase for my Organization. As an IS Auditor, what sort of questions should I pose t… Continue reading Questions to ask about SOC Solution
script-src-attr and script-src-elem directives are new additions in CSP3.
I am not able to understand how are they different from the script-src directive.
https://w3c.github.io/webappsec-csp/#directive-script-src-elem
This documents the… Continue reading CSP: What is script-src-attr and script-src-elem?
We have an application running in Amazon. A customer request some information about the security and I really not sure how to asnwer it. I ask for some kind of form so I try to fill it but they reply just give what we have.
… Continue reading What security information Im required to give to my customer [on hold]
I found that the security header for protection against mitm attacks in first connection is to implement HSTS preload directive and add the list of google: https://hstspreload.org/
However the requisites to do that is to inc… Continue reading HSTS preload and requisites on domain – subdomains must be added too?
I am creating a platform which is based on REST APIs. My platform has apps and web both.
I don’t want to make my APIs public and want that my APIs can be used by my own clients (app and web) only.
I can use the secret key s… Continue reading How to secure apis so that it can be used by my app and web only
In this help site, Adobe recommends not setting CSP for web fonts saying:
The CSP policy does not allow you to set an exception for inline styles added by a script from a specific domain.
and
Adobe Fonts uses inline… Continue reading Why does Adobe recommend not setting CSP headers for its web fonts?