<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi,<div class=""><br class=""><div class="">regarding TLS best practices, BSI TR-02102-2 (Version 2018-01) might be a good starting point;</div><div class=""><a href="https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2.pdf" class="">https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2.pdf</a></div><div class="">(Unfortunately in German only)</div><div class=""><br class=""></div><div class="">NIST provides something similiar with SP 800-52 Rev. 2 (Draft);</div><div class=""><a href="https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/draft" class="">https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/draft</a></div><div class=""><br class=""></div><div class="">Generally these kind of guidelines/documents tend to get outdated</div><div class="">very quickly as technology moves forward very fast.</div><div class=""><br class=""></div><div class="">Cheers</div><div class="">Dominic</div><div class=""><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><span><span><span><span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><span><span><span><span><span><span><br class="Apple-interchange-newline" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">
</span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></span></div>
<div><br class=""><blockquote type="cite" class=""><div class="">Am 12.10.2018 um 08:23 schrieb Frank Thommen <<a href="mailto:f.thommen@dkfz-heidelberg.de" class="">f.thommen@dkfz-heidelberg.de</a>>:</div><br class="Apple-interchange-newline"><div class=""><div class="">Every one to two years seems fine to me as "consumer". Maybe with emergency updates in-between when critical issues appear?<br class=""><br class="">Ideally the website would announce, that the document is regularly updated.<br class=""><br class="">frank<br class=""><br class=""><br class="">On 11/10/18 22:05, Susan E. Sons wrote:<br class=""><blockquote type="cite" class="">There are some corners of the guide that are out of date, but I haven't<br class="">yet found a better resource to point operators to if they aren't<br class="">familiar with these security concerns.<br class="">I'm constantly coming across problems caused by even the software<br class="">developers' "best practice" recommendations being completely wrong. For<br class="">example, several major CMSes advise that all executable parts of the CMS<br class="">be writable by the web server! Well-meaning admins follow these best<br class="">practices guides not knowing that they are making their installations<br class="">insecure by doing so.<br class="">If there were an effort to update the existing material, however, I<br class="">could probably chip in a small amount of effort from my staff at the<br class="">Center for Applied Cybersecurity Research to assist with those updates.<br class="">A new version every year or two may be the best we can do.<br class="">Susan<br class="">On 10/11/2018 01:14 PM, Frank Thommen wrote:<br class=""><blockquote type="cite" class="">Hello,<br class=""><br class="">recently someone asked, if this (bettercrypto?) project is dead. My<br class="">impression is, that it is at least extremely passive. Not being a<br class="">security and network protocol expert I nevertheless think that the<br class="">"Applied Crypto Hardening" paper of 2016<br class="">(<a href="https://bettercrypto.org/static/applied-crypto-hardening.pdf" class="">https://bettercrypto.org/static/applied-crypto-hardening.pdf</a>) is<br class="">probably very, very outdated and maybe even dangerous to rely on.<br class=""><br class="">Questions:<br class=""><br class=""> a) Is there some kind of successor project/paper with up to date<br class=""> copy-paste recommendations for good security settings as they<br class=""> were published in this paper (which was fantastic at the time)?<br class=""><br class=""> b) could/should the paper of 2016 not better be removed from the<br class=""> website?<br class=""><br class=""><br class="">Cheers<br class="">frank<br class="">_______________________________________________<br class="">Ach mailing list<br class=""><a href="mailto:Ach@lists.cert.at" class="">Ach@lists.cert.at</a><br class="">https://lists.cert.at/cgi-bin/mailman/listinfo/ach<br class=""></blockquote></blockquote><br class="">_______________________________________________<br class="">Ach mailing list<br class=""><a href="mailto:Ach@lists.cert.at" class="">Ach@lists.cert.at</a><br class="">https://lists.cert.at/cgi-bin/mailman/listinfo/ach<br class=""></div></div></blockquote></div><br class=""></div></div></body></html>