HTTP Strict Transport Security Becomes Internet Standard | News | ChannelWorld.in
This ad will automatically close in seconds Close

HTTP Strict Transport Security Becomes Internet Standard

Added on Nov 23, 2012 by Lucian Constantin

A Web security policy mechanism that promises to make HTTPS-enabled websites more resilient to various types of attacks has been approved and released as an Internet standard -- but despite support from some high-profile websites, adoption elsewhere is still low.

HTTP Strict Transport Security (HSTS) allows websites to declare themselves accessible only over HTTPS (HTTP Secure) and was designed to prevent hackers from forcing user connections over HTTP or abusing mistakes in HTTPS implementations to compromise content integrity.

The Internet Engineering Task Force (IETF), the body responsible for developing and promoting Internet standards, published the HSTS specification as an official standards document, RFC 6797, on Monday. IETF's Web Security Working Group had been working on it since 2010, when it was first submitted as a draft by Jeff Hodges from PayPal, Collin Jackson from Carnegie Mellon University and Adam Barth from Google.

HSTS prevents so-called mixed content issues from affecting the security and integrity of HTTPS websites. Mixed content situations occur when scripts or other resources embedded into an HTTPS-enabled website are loaded from a third-party location over an insecure connection. This can be the result of a development error or it can be intentional.

When the browser loads the insecure resource it makes a request over plain HTTP and can also send the user's session cookie along with it. An attacker that can intercept the request using networking sniffing techniques can use the cookie to hijack the user's account.

The HSTS mechanism also prevents man-in-the-middle attacks, where the attacker is in a position to intercept a user's connection with a website and force his browser to access the site's HTTP version instead of HTTPS. This technique is known as HTTPS or SSL stripping, and there are tools available to automate it.

When the browser connects over HTTPS to a website that supports HSTS, the site's strict transport security policy is saved and remembered for a specified amount of time. From that point forward, as long as the cached policy doesn't expire, the browser will refuse to initiate insecure connections with that website.

The HSTS policy is transmitted through an HTTP response header field called Strict-Transport-Security. The same header can be used to update and renew the policy.

HSTS is one of the best things to have happened to SSL because it fixes some of the mistakes made when originally designing the protocol 18 years ago, Ivan Ristic, director of engineering at security firm Qualys, said on Thursday. It also addresses the changes that have occurred since then in how Web browsers operate today, he said.

For example, relying on certificate warnings was a big mistake because users developed a habit of ignoring and overriding them, Ristic said. In the majority of situations that's not a big issue, but in 1 percent of cases it can be dangerous, he said.

HSTS does not rely on certificate warnings. If a problem is detected with the HTTPS implementation, the browser will simply refuse the connection and won't offer users the opportunity to override the decision, Ristic said.

Even with HSTS enabled on a website, there is still a small opportunity for attacks when the browser visits the website for the first time and doesn't have an HSTS policy saved for it . At that point an attacker could block it from reaching the HTTPS version of the site and could force the connection to use HTTP.

In order to address this, browsers such as Chrome and Firefox come with pre-loaded lists of popular websites for which HSTS is enforced by default.

According to SSL Pulse, a project that monitors HTTPS implementations on the world's most visited websites, only around 1,700 out of the top 180,000 HTTPS-enabled websites support HSTS.

In addition to the overall HSTS adoption rate being low, some of the websites that do support the feature have implementation issues, Ristic said.

For example, some of them specify a very short validity period -- also known as the time to live -- for their HSTS policies. For HSTS to be useful these records should be valid for days, if not months, he said.

Ristic doesn't believe that HSTS becoming an official standard will necessarily drive adoption numbers up. Website operators have traditionally been opportunistic and have implemented whatever worked for them, regardless of whether it was a standard or not, he said.

"I think the biggest problem with HSTS is education," Ristic said. "People need to learn that it exists."

Popular websites that support HSTS at the moment include PayPal, Twitter and various Google services. Facebook is in the process of deploying always-on HTTPS across its website, but doesn't support HSTS yet.

ChannelWorld Research

Why Channels Have Changed Their Go-to-Market Strategy in Six Months

According to our SOTM Mid-Year Survey, a majority of Indian channels said their top go-to-market strategy was to offer services in a recurring revenue model—not introducing new technologies, like SMAC, which was their top GTM strategy six months ago.

SOTM Mid-Year Survey 2015: Your Roadmap for the Next 6 Months

According to the survey, the next six months of the year are going to be eventful. Here are the challenges, emerging technologies and trends that will shape the rest of the year for you.

Big Data, Mobility Top Partners’ Wish List: SOTM Mid-Year Survey 2015

According to the ChannelWorld's State of the Mart Mid-Year Survey (SOTM) 2015, big data is the way to go for the enterprise channels for the second half of this year, with 34 percent partners planning to invest in it.

Private Cloud Still Remains a ‘Safe Bet’ for Partners: SOTM Survey 2015

According to the STOM 2015 survey, channel partners who are into cloud computing feel that 42 percent of their business will be generated by private cloud.

Partners Pin Hope on Government, Expects IT Spend to Grow: SOTM Mid-Year Survey 2015

According to the ChannelWorld's State of the Mart Mid-Year survey (SOTM) 2015, 30 percent of the channel partners believe that IT spend in the government sector is likely to increase in next six months.

No More Baby Steps, Partners Ready to ‘Risk’ Gambling with Disruptive Tech: SOTM Survey 2015

According to ChannelWorld’s State of the Mart Survey (SOTM) 2015, 43 percent of channel partners say their business will have a ‘high risk appetite’ in the second half of this year.

Channels’ 3 Great Expectations from Tech OEMs

Introduced as an individual category under ‘Expectations from tech OEMs’ list in SOTM Mid –Year Survey, ‘transparent deal registration’ emerged as the biggest concern for channel companies in India.

Latest Videos

Dynacons Scripts Successful Datacenter Strategy for India Inc: Parag Dalal, Dynacons

Strategic multi-OEM alliances, internal employee skillsets and long-lasting customer satisfaction are fundamental ingredients for a successful datacenter practice in today’s IT world, says Parag Dalal, Executive Director, Dynacons Systems & Solutions.

2015: A Game Changer Year for Security Channel Partners

Technology companies are adopting new-age security offerings to suffice the sophisticated threats and business demands of modern organisations. APT, Encryption, Next-Gen Firewall, Predictive Analysis, SIEM form the backbone of the company's security posture.

Why We Created a COE: Rajesh Mathkar, Wysetek Systems Technologists

Rajesh Mathkar, Director, Wysetek Systems Technologists, shares the rationale behind opening a center of excellence for virtualization and cloud computing and how it has benefited his business.

Editor's Pick

3 tips for a hassle-free Windows 10 upgrade

The waiting is almost over.

Understand Customers’ Business for Robust Security Posture: Harish Tyagi, Taarak India

Ownership and Manageability of the customers’ networks is the new order of the day. And they are asking advisory services than just security solutions, says Harish Tyagi, CEO, Taarak India

We are Planning to Add more Partners in Metropolitan Cities for Expansion: Puneet Datta, Canon India

The growing popularity and the potential of professional printing is opening new avenues for channel partners and Indian enterprises, says Puneet Datta, Director, professional printing products division (PPP), Canon India. 

SLIDESHOWS

7 Apps By The Indian Government You Need to Use

There are over hundreds of government initiated apps for Android, Apple and Windows devices. With Narendra Modi’s Digital India initiative, the government has released several new feature-rich smartphone applications.

SOTM Mid-Year Survey 2015: Your Roadmap for the Next 6 Months

According to the survey, the next six months of the year are going to be eventful. Here are the challenges, emerging technologies and trends that will shape the rest of the year for you.

The State of the Internet

Akamai's Q1 2015 state of the internet report provides insights into key global statistics including connection speeds, broadband adoption (fixed and mobile networks), and IPv4 exhaustion and IPv6 implementation.

India Software Market on an Upswing

According to IDC, the Indian software market has witnessed consistent growth of 10 percent since the second half of 2014, showing signs of growth and revival. 

7 Jobs Technology Has Replaced

Albert Einstein said once that it has become appallingly obvious that our technology has exceeded our humanity. With every invention of technology some poor soul becomes vulnerable to losing his or her job in some corner of the world. Here are few jobs that will cease to exist soon.

India's Leading VADs

Why Channels Want to Partner With Inflow Technologies

Inflow Technologies’ tie up with 39 vendor companies, an extensive tech portfolio, and a services play, are great value propositions for enterprise channels, says its President and CEO, Byju Pillai.

iValue Creates Real Value for Channels in India

Focused on niche vendor alliances around data, network and app management backed by a robust channel ecosystem marked iValue's success in 2014. What clicked for the seven-year-old VAD?

RAH Infotech Shows Channels the Way Ahead

Mutual trust and long lasting bond with vendor companies and channel partners helps VADs to evolve and succeed in today’s aggressively competitive market. Leveraging competent channel partners and forge niche vendor alliances marks RAH Infotech’s success in 2014.

How Satcom Infotech is Adapting to New Security Landscape

As a leading value added distributor, Satcom Infotech is emerging as an end-to-end security player, helping both customers and partners grow.

How ComGuard Shields Channel Partners

As emerging technologies introduce new threats to the enterprise landscape, they are making channel partners anxious. But VADs like ComGuard are putting their worries to rest. Here's how.

Tech Chat

Collaborating To Outcome Based World: Priyadarshi Mohapatra, Avaya

Priyadarshi Mohapatra, Managing Director, India and SAARC, Avaya, on how IT is transitioning from a keep-the-lights-on role to one that enables customers to deliver results.

The Dawn of the Digital Age: Akhilesh Tuteja, KPMG

The development of digital infrastructure will be a key growth driver for technology and solution providers. 

Paradigm Shift from End-Users to User-First : Parag Arora,Citrix

Parag Arora, Area Vice President and India Head, India Sub-continent, Citrix, says new technologies will force organizations to take a user-first approach in 2015.

Mobile and Cloud Are Gamechangers of the Future: Karan Bajwa, Microsoft

Karan Bajwa, Managing Director, Microsoft India, says, in  2015, organizations will adopt a mobile-first and cloud-first strategy to get ahead of competition.

A Network for the Internet of Everything : Dinesh Malkani,Cisco

Dinesh Malkani, President, India and SAARC, Cisco, talks about IoT and the significant technology transitions in the networking world.

Moving to the Third Platform: Jaideep Mehta, IDC

Cloud and mobility are the two technologies that will fuel the rapid adoption of the third platform in India.

Envisaging a Holistic Security Strategy For 2015: Sanjay Rohatgi,Symantec

Sanjay Rohatgi, President–Sales, Symantec India, says the company has a set of holistic solutions in place to secure organizations from security threats. 

Beating the Bad Guys: Sivarama Krishnan, PwC

Organizations will need to turn inwards to establish robust information security strategies.

Building Capabilities for a Digital Tomorrow: Alok Ohrie,Dell

Alok Ohrie, President and Managing Director, Dell India, on the company’s investments to build end-to-end solutions and delivery capabilities for a digital world.

FAST TRACK

Kamtron Systems

Transitioning towards a service-oriented company will boost our growth, believes Kavita Singhal, director, Kamtron Systems.

TIM Infratech

Delivering ‘best of breed’ technologies to enterprises is key to success, says Monish Chhabria, MD, TIM Infratech

Mudra Electronics

A vendor-agnostic strategy helped us sustain business, says Bharat Shetty, CMD, Mudra Electronics.

Systematix Technologies

Our USP is a customer-friendly approach backed by services, says Akhilesh Khandelwal, Director, Systematix Technologies.

CorporateServe Solutions

Our ability to turnaround complex ERP projects in record time is what gets us customer referral, says Vinay Vohra, Founder & CEO, CorporateServe Solutions.

KernelSphere Technologies

We are emerging as an end-to-end systems integrator, says Vinod Kumar, MD, KernelSphere Technologies.

Uniware Systems

We constantly validate emerging technologies for first-mover advantage, says Vergis K.R., CEO, Uniware Systems.

Astek Networking & Solutions

An innovative approach helps us stay successful, says Ashish Agarwal, CEO, Astek Networking & Solutions.

CSM Technologies

Our approach is backed by innovation and simplicity, says Priyadarshi Nanu Pany, CEO, CSM Technologies.

SOCIAL MEDIA @ CW India
SIGNUP FOR OUR NEWSLETTER

Signup for our newsletter and get regular updates.