HTTPS Configuration: Who’s Responsible?

G5 Cyber Security

1 week ago

TL;DR

Security teams should own HTTPS configuration, but it requires close collaboration with DevOps and web development teams. Developers implement, DevOps automate, Security reviews and enforces policy.

1. Why is this important?

HTTPS isn’t just about a padlock in the browser anymore. It’s fundamental to trust, data security, SEO ranking, and increasingly, regulatory compliance (like GDPR). Incorrect configuration can lead to:

Data breaches: Sensitive information exposed.
Loss of Trust: Users won’t visit insecure sites.
SEO Penalties: Google prioritises HTTPS websites.
Compliance Issues: Fines and legal problems.

2. Roles & Responsibilities

Here’s a breakdown of who should do what:

2.1 Security Team (Ownership)

Policy Definition: Define the HTTPS standards for your organisation (e.g., TLS version, cipher suites, certificate authorities).
Risk Assessment: Identify potential vulnerabilities and threats related to HTTPS.
Review & Audit: Regularly review configurations to ensure compliance with policy. Use tools like SSL Labs’ SSL Server Test.
Incident Response: Handle security incidents related to HTTPS (e.g., certificate compromise).

2.2 DevOps Team (Automation & Maintenance)

Automated Certificate Management: Implement Let’s Encrypt or similar tools for automatic certificate issuance and renewal.
```
certbot certonly --webroot -w /var/www/yourwebsite -d yourdomain.com
```
Configuration Deployment: Automate the deployment of HTTPS configurations across all servers using Infrastructure as Code (IaC) tools like Terraform or Ansible.
Monitoring & Alerting: Set up monitoring to detect certificate expiration, weak cipher suites, and other issues.

2.3 Web Development Team (Implementation)

Code Integration: Ensure web applications are configured to redirect HTTP traffic to HTTPS.
HSTS Implementation: Implement HTTP Strict Transport Security (HSTS) to force browsers to use HTTPS. Add the following header in your server configuration:
```
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
```
Content Security Policy (CSP): Implement CSP to mitigate cross-site scripting (XSS) attacks.

3. Practical Steps for Implementation

Establish a Clear Policy: Document your HTTPS requirements, including TLS versions (TLS 1.2 or higher), cipher suites, and certificate authorities.
Automate Certificate Management: Use Let’s Encrypt or ACME clients to automate the issuance and renewal of certificates.
Implement HSTS: Configure your web server to send the HSTS header. Start with a small max-age value and gradually increase it as you gain confidence.
Regularly Scan for Vulnerabilities: Use tools like SSL Labs’ SSL Server Test to identify and fix any configuration issues.
Monitor Certificate Expiration: Set up alerts to notify you of expiring certificates.
Review Configurations Regularly: Conduct periodic reviews of your HTTPS configurations to ensure compliance with policy.

4. Tools to Help

SSL Labs’ SSL Server Test: https://www.ssllabs.com/ssltest/ – Comprehensive HTTPS testing.
Let’s Encrypt: https://letsencrypt.org/ – Free, automated certificate authority.
Certbot: https://certbot.eff.org/ – ACME client for Let’s Encrypt.