05/10/2016 – Talk by Stefano Calzavara

Title: Theory and Practice of CSP
Time: 13:00
Location: Meeting room, Building Zeta
Type: Research Result
Speaker: Stefano Calzavara
Abstract:Content Security Policy (CSP) is a recent W3C standard introduced to prevent and mitigate the impact of content injection vulnerabilities on websites. In this talk we present a systematic, large-scale analysis of the effectiveness of the current CSP deployment, focusing on four key aspects: browser support, website adoption, correct configuration and constant maintenance. Our analysis shows that browser support for CSP is largely satisfactory, with the exception of few notable issues, but unfortunately there are several shortcomings relative to the other three aspects. CSP appears to have a rather limited deployment as yet and, more crucially, existing policies exhibit a number of weaknesses and misconfiguration errors. Moreover, content security policies are not regularly updated to ban insecure practices and remove unintended security violations. We finally discuss how formal methods are an effective tool to substantiate the claims of our empirical evaluation.