Security – not just a ranking factor

What does it mean to have a secure website? It can be several things:

• Secret information stays secret.
• Your visitors take no risks when they visit the site.
• Information is available when needed.
• The site is considered credible and gets better rankings.
  

In the popular measurement tool Webperf, websites are given higher scores if they show good security and therefore we may be tempted to polish our CSP and tweak settings for HSTS and other things. Google and others are also likely to give your site a higher score if it is considered secure. But what does all this mean besides a better ranking?

Safety for your visitors

Visitors can get into trouble when they visit your website. Even if you've plugged all the holes for hackers to mess with your visitors through your website, there are ways to provide guarantees so that visitors and search engines understand that your site is safe. If you implement a Content Security Policy (CSP), you make it clear to modern browsers in what this way you make it impossible for hackers to try to use clever tricks with iframes, javascript and other things to trick your visitors. I recommend starting to work with CSP directly in new websites as it can be time-consuming afterwards to inventory which parts of a website should be allowed and what can be blocked.

In Sitevision, there are more settings that can often be activated without worry to directly improve security for visitors:

• Strict-Transport-Security (HSTS) = Requires that the website always loads through
  HTTPS.
• Referrer-Policy = Does not send visited address to third parties (may contain personal information).
• X-Content-Type-Options = Counteracts "mime-sniffing" for downloaded resources.

Security of the server

Protecting the server means limiting access to secret information but also ensuring that your website is always accessible to your target audience. To start with, it is important to be careful with the permissions. Use federated login with two-factor authentication if possible, even for consultants, as logging in with a standard username and password is considered to be a weak protection – largely due to the human factor.

If a RestApp is built for external access, a user account should be created for access to the app only. If this user is given access to more than just the app, there is a risk of exploitation. Instead, the app may access resources via a service user, who in turn does not have the ability to log in. In general, users should be granted access to what they really need, for as long as they need it (principle of least privilege). Permissions should managed by groups rather than by individuals, to make it easier to clean up afterwards.

The WebDAV protocol can help in website migration as it allows both reading and writing of files, but avoid using "/webdav" in website paths as it becomes a clear target for attacks.

Custom WebApps and RestApps can pose a security problem if they run slowly and use a lot of server resources. It is easy for attackers to find pages that load unusually slowly and focus DDoS attacks on them. Therefore, measuring app performance with the parameter ?profiling=true is also useful from a security perspective.

Preparing a crisis website

If your website is operated on-prem, you probably have redundancy in internet connections and power supply as well as various security routines around the physical, but if the worst should happen, it would be good to have prepared a crisis website. The purpose of such a website is to have the most important information available to your target audience in case of crisis, even if the primary server environment is not accessible. In this situation, it is important that the environment for the crisis website is located in a separate geographical location, preferably within the Swedish border. Sitevision has a packaged offer for this for both on-prem and cloud customers.

Want to know more?

Reviewing the security of your website gives you both a better ranking factor and a reduced risk of your visitors or your information getting hurt. The measures are sometimes trivial and sometimes more complex – and there is a lot to adjust. In this article, I've focused on some common points, but there's more: SRI, CORS, CSRF, DKIM... Feel free to contact me to see how we can help you with your security efforts!