Improvement of SSL/TLS security for web application

Task: The task involved enhancing the SSL/TLS configuration security level of the web application [NDA] to ensure reliable data encryption transmitted between the server and clients. The goal is to protect against Man-in-the-Middle attacks, weak cipher abuses, and other threats related to improper SSL/TLS configuration.

The work included:

— Audit of the current SSL/TLS configuration: Checking the protocols, ciphers, and settings used for compliance with best security practices.
— Disabling insecure protocols: Turning off outdated and vulnerable protocols such as SSL 2.0 and TLS 1.0/1.1 to prevent POODLE attacks and other vulnerabilities.
— Configuring strong ciphers: Ensuring the use of only reliable ciphers for encrypting transmitted data.
— Implementing HSTS (Strict-Transport-Security): Setting up HSTS to enforce HTTPS on all connections, protecting against downgrade attacks.
— Audit and configuration of certificates: Verifying the correctness of SSL certificate installation, their compliance with domains and validity periods, as well as configuring certificates using modern signing algorithms (e.g., SHA-256).
— Testing for SSL/TLS protocol vulnerabilities: Conducting vulnerability tests on SSL/TLS using tools such as SSL Labs and ssltest.sh to check for known threats.
— Optimizing configuration settings: Making changes to achieve a balance between security and performance, including configuring optimal session key and session parameters.

Result: As a result of the work done, the web application received a significantly improved SSL/TLS configuration that provided a high level of protection against transport protocol level attacks. All test checks were successful, confirming compliance with industry best security practices.