Security Questions

[jp24]

As part of pen testing the following came back, is it possible to address these in OneView?

Username Enumeration - it was found to respond differently to existing and non-existing users which made it possible to enumerate legitimate users

Security Response Headers - the host did utilise common security headers as those recommended by OWASP secure headers project

[BhaskarV]

Hi @jp24

Are you finding these with OneView 4.00 or 4.10?
The specific issue below you have stated:
Username Enumeration - it was found to respond differently to existing and non-existing users which made it possible to enumerate legitimate users
This defect has been fixed in a more recent version of OneView yet to be released.

On the below:
Security Response Headers - the host did utilise common security headers as those recommended by OWASP secure headers project
Did this come back as a violation in the pen-test result?

Regards,
Bhaskar

[jp24]

Hi Bhaskar,

Thank you for the reponse. These were related to version 4.10 of the Appliance.

Username Enumeration - Are you able to advise which version this may be?

Security Response Headers - although not defined critical from pen-test results which i understand follow industry standards it was their findings,  the calissifcation by the client may/see see it differently and prevent rollout.

[BhaskarV]

Hi @jp24

The next upcoming OneView release right after 4.10, has the fix for the username enumeration problem.

On the request headers that are flagged as a violation by OWASP,  can you share any details on that?

Regards.
Bhaskar

[jp24]

Redacted Feedback 

Recommendation
It is strongly recommended recommend that the following security response headers are implemented in their highlighted
configuration:
 X-XSS-Protection: 1; mode=block
 Strict-Transport-Security: max-age=31536000; includeSubDomains
 X-Content-Type-Options: nosniff
 X-Frame-Options: deny
 Cache-control: no store
 Pragma: no-cache

References & Resources
 https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#tab=Headers
 https://www.owasp.org/index.php/Testing_for_Browser_cache_weakness_(OTG-AUTHN-006)

[BhaskarV]

Thanks @jp24  for sharing these.
Will check and respond.

[BhaskarV]

Hi @jp24 

Sorry about the delay.
The below headers are addressed in an upcoming release.

 X-XSS-Protection: 1; mode=block
 X-Content-Type-Options: nosniff
 X-Frame-Options: deny
 Pragma: no-cache

We are evaluating the below two still and we'll take them up approriately.
 Cache-control: no store
 Strict-Transport-Security: max-age=31536000; includeSubDomains

Thank you.

Regards,
Bhaskar

[jp24]

Thank you for the update.