Web Security Practices and SSL/TLS Protocols

Definition: SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are protocols that provide secure communication over a computer network.
Functionality:
- Encrypts data transmitted between the client and server.
- Authenticates the identities of the communicating parties.
Versions:
- SSL has been deprecated in favor of TLS.
- TLS 1.2 and TLS 1.3 are the most widely used versions today.

Use of HTTPS: Ensure websites use HTTPS rather than HTTP to encrypt data.
Regular Security Updates: Keep servers and applications updated to mitigate vulnerabilities.
Strong Password Policies: Enforce complex passwords and regular changes.
Content Security Policy (CSP): Implement CSP to prevent cross-site scripting (XSS) attacks.
Use of Security Headers: Employ headers like HSTS (HTTP Strict Transport Security) to enforce secure connections.

Role: Trusted entities that issue digital certificates to verify the ownership of encryption keys.
Types of Certificates:
- Domain Validated (DV): Basic validation of domain ownership.
- Organization Validated (OV): Includes verification of organization identity.
- Extended Validation (EV): Provides the highest level of trust through rigorous validation.
Trust Chain: Certificates are signed by a root certificate authority (CA) and may include intermediate CAs.

Establishing a Secure Connection: Involves a handshake process:
1. Client and server exchange supported protocols and cipher suites.
2. Server sends its digital certificate for validation by the client.
3. A secure session key is generated for the session.
Session Resumption: Techniques like session IDs and session tickets allow faster reconnections without a full handshake.

Symmetric Encryption: Uses the same key for encryption and decryption (e.g., AES).
Asymmetric Encryption: Uses a pair of keys (public and private) for secure data exchange (e.g., RSA).
Hash Functions: Ensure data integrity (e.g., SHA-256) by producing a fixed-size hash from input data.
Perfect Forward Secrecy (PFS): Ensures session keys are not compromised even if the private key is exposed later.

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) provide secure communication over networks.
Data transmitted between client and server is encrypted, enhancing confidentiality.
These protocols also authenticate the identities of the communicating parties.
SSL is deprecated; currently, TLS 1.2 and TLS 1.3 are the most widely adopted versions.

HTTPS should be used instead of HTTP to ensure data encryption during transmission.
Regular security updates are crucial for servers and applications to address vulnerabilities.
Strong password policies including complex passwords and regular updates are essential for security.
Content Security Policy (CSP) can mitigate cross-site scripting (XSS) attacks.
Implementing security headers like HTTP Strict Transport Security (HSTS) enforces secure connections.

Certificate Authorities (CAs) are trusted entities that issue digital certificates for encryption key ownership verification.
Domain Validated (DV) certificates ensure basic domain ownership validation.
Organization Validated (OV) certificates verify the identity of organizations.
Extended Validation (EV) certificates offer the highest trust level through extensive validation processes.
Digital certificates are signed by a root CA and may include intermediate CAs in a trust chain.

Establishing secure connections involves a handshake process between client and server:
- The client and server exchange supported protocols and cipher suites.
- The server provides its digital certificate for the client to validate.
- A secure session key is generated for the communication session.
Session resumption techniques like session IDs and tickets allow faster reconnections without restarting the handshake process.

Symmetric encryption employs the same key for both encryption and decryption (e.g., AES).
Asymmetric encryption uses a key pair (public and private) for secure data exchange (e.g., RSA).
Hash functions (e.g., SHA-256) ensure data integrity by producing a fixed-size hash from variable input data.
Perfect Forward Secrecy (PFS) guarantees that session keys remain secure even if the private key is compromised in the future.