No Better ROI: HTTP Headers for Security
Talkat AppSec California 2015 · on Tuesday, 2015-01-27· at 12:00· Annenberg Community Beach House: Track 3, 415 Pacific Coast Hwy·
summary
A fast checklist of what actually moves risk: a scanner (securityheaders.com) crawling the Alexa top 100,000 shows a median score of 2 out of 10, so adoption is shockingly low; adding X-Frame-Options immediately eliminates clickjacking, Content Security Policy substantially reduces XSS risk if iterated, and HSTS plus HSTS preload removes the initial HTTP downgrade window. Implementation costs are essentially zero vendor spend, minutes to hours for simple headers, and the measurable payoff is whole classes of vulnerabilities gone.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:31What We'Ll Learn Today
- 2:58Http Headers
- 6:19Headers for Security
- 8:12Click Tracking
- 10:08Content Security Policy
- 13:43Encryption
- 14:51The Http Strict Transport Security Policy
- 21:01Questions on Http Headers for Security
related talks
59mHTTP Security Headers You Need To Have On Your Web Apps
31mHTTP Security Headers: A Technology History Through Scar Tissue
21mSecurity with HTTP headers: overview of attacks and defenses
38mWhy Do We Need Security Headers?
30mSecurity with HTTP Headers: Overview of Attacks and Defenses
45mHeaders for hackers
52mSeatbelts for Web App (Security Headers)
46mHeaders for Hackers