Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- https://www.youtube.com/watch?v=-DNNlBYIyxQ (39:37)
- 1. HTTP redirect to HTTPS
- 2. TLS v1.2 or newer
- 3. Cipher suites:
- - server order preference enabled
- - ECDHE-AES{128,256}-GCM-SHA{256,384,512} at or near the top
- - remove RC4, DES, 3DES bulk ciphers
- - remove DH (non ephemeral) key exchanges
- - remove MD5, SHA1 MAC
- - check with https://ssllabs.com
- 4. Browser security headers:
- - add Strict-Transport-Security
- - add Content-Security-Policy
- - add Referer-Policy
- - add Feature-Policy
- - add X-Content-Type-Options
- - check with https://securityheaders.com/ and https://observatory.mozilla.com
- 5. DNS: add CAA records (low TTL, 10-30 seconds)
- 6. Content: add Sub Resource Integrity for stuff you don't control
- 7. Content: change Set-Cookie to add/inject: SameSite=Lax/Strict
- 8. Server: Enable HTTP/2
Advertisement
Add Comment
Please, Sign In to add comment
