Agenda

05 Ott 2016 13:00

Theory and Practice of CSP

Campus Scientifico via Torino - edificio ZETA, Sala Riunioni

Stefano Calzavara, Università Ca' Foscari Venezia

Abstract:
Content Security Policy (CSP) is a recent W3C standard introduced to prevent and mitigate the impact of content injection vulnerabilities on websites. In this talk we present a systematic, large-scale analysis of the effectiveness of the current CSP deployment, focusing on four key aspects: browser support, website adoption, correct configuration and constant maintenance. Our analysis shows that browser support for CSP is largely satisfactory, with the exception of few notable issues, but unfortunately there are several shortcomings relative to the other three aspects. CSP appears to have a rather limited deployment as yet and, more crucially, existing policies exhibit a number of weaknesses and misconfiguration errors. Moreover, content security policies are not regularly updated to ban insecure practices and remove unintended security violations. We finally discuss how formal methods are an effective tool to substantiate the claims of our empirical evaluation.

Lingua

L'evento si terrà in italiano

Organizzatore

ACADIA Research Centre

Cerca in agenda