Bank Grade Security
summary
Claims that Australian banks have “bank grade” security get tested against securityheaders.io, SSL Labs and the draft security.txt standard. Results show one bank earns an A+ (Up), under 10% get A, 27% C, 48% D and 9% fail to send any security headers. HSTS appears on ~80% but none are preload-ready, only three banks use CSP, one internet banking site scores F with known TLS vuln families (Zombie, GoldenDoodle, OpenSSL zero length), and 56% still support TLS 1.0.
AI-written summary · about
chapters (29)
- 0:00Introduction
- 1:26The List
- 1:58Neo Banks
- 3:38Tools
- 4:09HTTP headers
- 5:12Security Headers
- 6:05Results
- 7:35Awards
- 8:55HTTPStrict Transport Security
- 10:40How to get preloaded
- 11:37Initial assessment
- 13:22CSP
- 15:13Demo
- 17:03Observations
- 19:36SSL TLS
- 21:22SSL Labs
- 22:11SSL Pulse
- 25:56Unusual Responses
- 26:56TLS
- 29:18SSL
- 32:48Securitytxt file
- 35:58Toxic responses
- 37:28Securitytxt
- 38:35Facebook
- 39:30IYMP
- 40:29What can you do
- 42:23Other criteria
- 44:41Optics of security
- 46:51Links
related talks
40mWebsite security 101
59mProactively defending your business
37mHTTPS Is Better than Ever Before. Now Its Your Turn.
20mHow The Coasts Approach Information Security Differently
31m"I Have No Idea What I'm Doing" - On the Usability of Deploying HTTPS
53mHansel and Gretel do TLS
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
01h 01mHTTPS & TLS in 2016: Security practices from the front lines