So, if I followed that NIST framework we talked about earlier,
we've identified what the problem is,
we talked about how to protect in two different ways,
protecting in the browser and protecting at the web server,
but let's assume, you know, the thing happens,
the website's been owned, that one line of JavaScript is there,
how are we going to find it?
How can we detect, and this is a really interesting problem,
how do we detect that one line of script tag added to a
page delivered to a consumer browser?
So,
are you going beyond detection insofar as you might have
intrusion detection systems and things like this,
so you're sort of saying, look, someone has gotten in and they've left something,
how do we now discover that your web page has moved from a
known good state into something else?
Absolutely.
How do we do that?
And I think you showed us something with the CSP that would say,
if the script ran in the consumer browser,
it's going to say, hang on, that's not allowed to run,
and you can report it somewhere.
Yeah, in fact, there's sort of a nuance to the CSP,
so the CSP will say this is what's allowed to run from where,
if someone put a block of script, the CSP can also,
in fact, by default the CSP doesn't let you have a block of script,
you actually have to enable it and do certain things there,
but I think you're also sort of talking about
attacks where the web server is owned,
and we just had the discussion about the fact that the web server is owned,
then they can take out out the CSP or anything like that.
They can take out the CSP.
But we could detect that, couldn't we?
If they took it, if we had a CSP, so say we've got,
so, let's imagine we've done this.
We've gone and done SRI for our resources,
we've put a CSP in place, and then the bad guy comes along,
he puts his JavaScript in there, he either edits the CSP to include his host,
or he takes out the CSP altogether.
That's one thing we could look for, isn't it?
Possibly externally, not natively within the site,
because if you're looking for that within the site,
you'd take out the thing that was looking for it,
it's very "Inception" now, but --- Yeah,
I know what you mean.
Because once your web server is owned, your web server is owned.
So you've got to have something independent.
Yeah.
If we were just looking to see if the CSP had changed or had been removed,
could we put something out on the internet that went to our website,
browsed the pages if it was a user, and then looked for that CSP?
You could,
so that the external service would have to have like a known good state of CSP,
and then it would have to identify a deviation,
of course your challenge then is that something like a CSP has to change
every time you pull in content from somewhere else,
so then your check for that has to change,
and we just had the discussion about the marketing department
wanting to put arbitrary script in there,
which means they-- stay with us here-- you have to put arbitrary script in,
which means you've also got to change the CSP,
which means you've also got to change your external detection,
which looks for a deviation of the CSP.
So, now I've got a process.
Now we need a process that says if I want to add a new
line of JavaScript to my website,
I need to follow a process that says I need to change the CSP,
and I need to change the thing externally that's checking for the CSP.
Yes, and like I get that some people will then turn around and say,
well, that's a lot of mucking around, but in fairness,
that maybe that is the discussion you need to have,
particularly if you're doing something like taking payment cards,
which kind of brings us back to the original point of this course.
Like,
you're not going to get out of all of this for free in terms of human effort.
But if we're seeing that 50% of criminal attacks are
going to payment cards or this, then as soon as they get payment cards,
it's going to be login credentials, it's going to be healthcare forms,
it's going to be anything where users are typing into their browser,
so it strikes me that you want to be able to check that.
It strikes me that, you know the world moves on,
you know, we didn't have firewalls, then we had firewalls,
we didn't have the OWASP top 10, then we have it,
I think this is maybe one of those the world has moved on,
and we need to be able to check what we're serving to our consumers,
and if the only way of doing that is by looking at
it externally like a consumer, we have to do that.
Yeah, fair call, fair call.
And that would be what, like, you just write curl,
you just do curl and then hash it or something?
Possibly, but of course,
it's a little bit more than that because you want the servers to run
unattended and you want it to notify you when it changes,
maybe someone out there has built a service for this,
that's maybe not a bad idea!
I haven't seen that, but --- Don't build a service if you've thought of this,
because I might do it, it sounds cool.
It sounds like a really good idea, doesn't it?
I mean, there are services out there,
there are vulnerability scanning services that would
tell you if something's changed, so you could ask them to tell you that,
so there's some commercial services like that,
but nothing I've seen that's exactly focused on this.
I think that would be quite a cool idea, actually.