Webzurich - The State of Web Security in Switzerland

transcript

BinaryEdge.ioBe Ready. Be Safe. Be Secure.

The State of Web Security in Switzerland

AGENDA

Who am I?

What do we do?

Switzerland and Cybersecurity

Headers

Dataleaks affecting Switzerland

Data exposed

WHO AM I?

Tiago Henriques

Tiago is the CEO and Data necromancer at BinaryEdge however he gets to meddle in the intersection of data science and cybersecurity by providing his team with lovely problems that they solve on a daily basis.

WHAT DO WE DO?

Files People

Social

Companyregistration

internal

external

Linked urls

AS membership

AS peer

List of IPs

Sharedinfrastructure

Co-hostedsites

Contact

Geolocation

Officelocations

Socialnetworks

portscan

torrents

Screenshots

Services

http https

AppsFiles

Peers Torrent name

BannersImage

Classifier

Vulnerabilities

200Ports scanned

per month

>120 millionIPs with services

> 1.5 billionEvents generated

per month

DATA POINTS

metadata

PhotosFamily&friends

Behaviour

LikesTopics

Search

NewsForums

Sub-reddits

DomainsAXFRMX records

WebserverFrameworkHeadersCookies

CertificateConfigurationAuthoritiesEntities

SWip addressurl address

WHAT DO WE DO?

balgan@DESKTOP-PAGM894 /cygdrive/d/270m domains/cctld_lists$ head ch.csvgoogle.chuploadable.cheztv.chprojectfreetv.chblick.chricardo.chwatchseries-online.ch20min.chcokeandpopcorn.chbluewin.ch

balgan@DESKTOP-PAGM894 /cygdrive/d/270m domains/cctld_lists$ cat ch.csv | wc -l1533995

SWITZERLAND AND CYBERSECURITY

INSURANCEBANKING PHARMA

SWITZERLAND AND CYBERSECURITY

Source: https://securityheaders.io

SERVER

STRICT-TRANSPORT-SECURITY

X-FRAME-OPTIONS

X-CONTENT-TYPE-OPTIONS

X-XSS-PROTECTION

CONTENT-SECURITY-POLICY

PUBLIC-KEY-PINS

This Server header seems to advertise the software being run on the server but you can remove or change this value.

HTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.

X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjack-ing.

X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is “X-Content-Type-Options: nosniff!”.

X-XSS-Protection sets the configuration for the cross-site scripting filters built into most browsers. The best configuration is “X-XSS-Protection: 1; mode=block”.

Content-Security-Policy is an effective measure to protect your site from XSS attacks. By wh-itelisting sources of approved content, you can prevent the browser from loading malicious assets. Analyse this policy in more detail.

HTTP Public Key Pinning protects your site from MiTM attacks using rogue X.509 certificates. By whitelisting only the identities that the browser should trust, your users are protected in the event of a certificate authority is compromised. Analyse this policity in more detail.

HEADERS

Most Common Server Headers (top20)

HEADERS

0 35,00017,5008,750 26,250

Strict-Transport-Security

X-XSS-Protection

Content-Security-Policy(report + enforced)

Public-key-Pins(report + enforced)

X-Content-Type-Options

X-Frame-Options

32,687

31,552

20,220

16,444

Most Common Security Headers in Switzerland

HEADERS

BANKS - WEBSITES

UBS.COM

CREDIT-SUISSE.COM

JULIUSBAER.COM

POSTFINANCE.CH

BANKCOOP.CH

FALCONPB.COM

X-frame-options

Content-Security-Policy

Public-Key-Pins

X-XSS-Protection

SECURITY HEADER

DOESN’T HAVE SECURITY HEADER HAS SECURITY HEADER

RAIFFEISEN.CH

HEADERS

BANKS - E-BANKING

UBS.COM

CREDIT-SUISSE.COM

JULIUSBAER.COM

POSTFINANCE.CH

BANKCOOP.CH

FALCONPB.COM

X-frame-options

Public-Key-Pins

X-XSS-Protection

SECURITY HEADER

RAIFFEISEN.CH

BANKS - E-BANKING

UBS.COM

CREDIT-SUISSE.COM

JULIUSBAER.COM

POSTFINANCE.CH

BANKCOOP.CH

FALCONPB.COM

X-frame-options

Public-Key-Pins

X-XSS-Protection

SECURITY HEADER

RAIFFEISEN.CH

THIS IS HARD TO DO RIGHT!

HEADERS

https://www.troyhunt.com/how-chromes-buggy-content-security-policy-implementation-cost-me-money/

HEADERS

CANTONAL BANKS CYBER COMPETITION - E-BANKING

ZÜRCHER (ZKB.CH)

VAUDOISE (BCV.CH)

BASLER (BKB.CH)

LUZERNER (LUKB.CH)

ST.GALLER (SGKB.CH)

BERNER (BEKB.CH)

X-frame-options

Public-Key-Pins

X-XSS-Protection

SECURITY HEADER

HEADERS

INSURANCE COMPANIES

ZURICH FINANCIAL SERVICES

SWISS RE

WINTERTHUR GROUP

SWISS LIFE

BALOISE

HELVETIA PATRIA

X-frame-options

Public-Key-Pins

X-XSS-Protection

SECURITY HEADER

HEADERS

INVALID CONFIGURATION

GROUPE ALLIANZ (SUISSE)

LA MOBILIERE

VAUDOISE ASSURANCES

PHARMACEUTICAL/CHEMICAL COMPANIES

NOVARTIS

SYNGENTA

CLARIANT

X-frame-options

Public-Key-Pins

X-XSS-Protection

SECURITY HEADER

HEADERS

aerzte-zh.ch/

HEADERS

X-FRAME-OPTIONS

X-XSS-PROTECTION

STRICT-TRANSPORT-SECURITY

CONTENT-SECURITY-POLICY

PUBLIC-KEY-PINS

X-CONTENT-TYPE-OPTIONS

130 DOCTOR WEBSITES

DATA LEAKS

http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/

DATA LEAKS AFFECTING SWITZERLAND

26,763

Credit Suisse

14,262

Julius Bär

ZürcherKantonalbank

Raiffeisen

BanqueCantonale Vaudoise

PostFinance

FalconPrivate Bank

St. GallerKantonalbank

LuzernerKantonalbank

BernerKantonalbank

BaslerKantonalbank

Bank Coop

INSURANCE COMPANIES

ZurichFinancialServices2,753

Swiss Re

WinterthurGroup

Swiss Life

Baloise

HelvetiaPatria

Groupe Allianz (Suisse)

La Mobiliere

VaudoiseAssurances

PHARMACEUTICAL/CHEMICAL COMPANIES

Novartis

19,872

17,708

Syngenta

Clariant

DATA EXPOSEDDATA EXPOSED

Big Data TechnologiesChanges in amount of data exposed on the internetMongoDB Memcached Redis 2 TB

644.3 TB

Aug 2015 Jan 2016 July 2016

724.7 TB 627.7 TB

13.2 TB11.3 TB

710.9 TB 12.0 TB

598.7 TB 27.5 TB 1.5 TB

1.8 TB

619.8 TB

DATA EXPOSEDDATA EXPOSED

BE READY. BE SAFE. BE SECURE.

www.binaryedge.io

CONTIGENCY THREAT SAFE IRRELEVANT

Webzurich - The State of Web Security in Switzerland

Technology