Web Security

Learning outcomes:

  • Describe common website attacks, such as SQL injection and defacing
  • Explain how websites, and the people using them, can be protected from attacks
  • Explain how HTTPS and certificates work, and what happens when a certificate authority is compromised
  • Compare the benefits and risks of single sign-on and VPNs

Would you like to download my PowerPoint to follow along?

  • Hacking a website
  • Protecting a website
    • Updating
    • Frameworks
    • Apps and add-ons, such as WordPress plugins
    • Securing pages and uploads
    • Checking inputs and files
  • Client side attacks
    • Sniffing
    • Tracking cookies and supercookies
    • Browser fingerprinting
  • Client side defense
    • Browser settings and privacy mode
    • Tor
    • HTTPS always
    • Blocking cookies and JavaScript
  • HTTPS and certificates
    • What is HTTPS?
    • What is a certificate?
    • Certificate authorities
      • For profit, and non-profit such as Let's Encrypt
      • Authenticating users
      • Trusted certificates
      • When it goes wrong: DigiNotar and Comodo
      • Revocation
      • Entrust (2024): Chrome stopped trusting its certificates after years of compliance failures (Google Security Blog)
      • Shorter certificate lifetimes: 200 days from March 2026, and 47 days by 2029, so renewals have to be automated (CA/Browser Forum)
  • Single sign-on
    • Reduces password fatigue
    • Reduces IT costs and time spent on authentication
    • "Keys to the castle": one stolen login opens everything
    • Should include two factor authentication
    • Censorship in some countries can block the third party
  • VPN
    • What is a VPN?
    • Why would a business want one?
    • What about a consumer?
    • What are the risks of a VPN?
    • What are some less known benefits?

Suggested Activities and Discussion Topics:

  • Discussion: would you use single sign-on for everything? Why or why not?
  • Activity: click the padlock in your browser on a site you use often, and look at its certificate. Who issued it, and when does it expire?
  • Follow the instructions on this PDF (accessible HTML version)

Would you like to see some more classes? View all classes