Authors:
Riccardo Germenia
1
;
2
;
Salvatore Manfredi
2
;
Matteo Rizzi
1
;
2
;
Giada Sciarretta
2
;
Alessandro Tomasi
2
and
Silvio Ranise
2
;
3
Affiliations:
1
Department of Information Engineering and Computer Science, University of Trento, Via Sommarive 9, Trento, Italy
;
2
Center for Cybersecurity, Fondazione Bruno Kessler, Via Sommarive 18, Trento, Italy
;
3
Department of Mathematics, University of Trento, Via Sommarive 14, Trento, Italy
Keyword(s):
Compliance Analysis, National Guidelines, Auditable Dataset, TLS Deployments.
Abstract:
System administrators tasked with configuring TLS servers must make numerous decisions - e.g., selecting the appropriate ciphers, signature algorithms, and TLS extensions - and it may not be obvious, even to security experts, which decisions may expose them to attacks. To address this issue, raise awareness, and establish a security threshold, numerous cybersecurity agencies around the world issue technical guidelines for the use and configuration of TLS. In this paper we carry out an assessment of the TLS security posture of European and US based endpoints in relation to their respective national cybersecurity guidelines. Our results show that a surprisingly high amount of the analyzed websites have a low compliance level when compared to their respective national guideline. We attempt to identify potential causes by presenting a series of observations that may underlie the lack of compliance. The analysis is conducted by employing a TLS analyzer we developed to automate the complia
nce analysis and the application of the suggested changes, assisting system administrators during this important yet complex task. Our tool and the dataset containing the machine-readable requirements for automating conformity assessment are publicly available, thus making the process auditable and the assets extensible.
(More)