Security | Marcel Wiedemeier

Achieving a Perfect 120/100 A+ Mozilla Observatory Rating with Modern HTTP Headers

Wed, 09 May 2018 18:00:00 +0200

Modern web applications face an increasingly sophisticated threat landscape: Cross-Site Scripting (XSS), Clickjacking (UI Redressing), MIME-type confusion attacks, Man-in-the-Middle (MITM) session hijacking, and unauthorized third-party tracking. While modern frameworks offer built-in escaping, the definitive defense layer lies at the HTTP protocol level: HTTP Security Response Headers.

When building the static website for local business Zorig, my goal was not merely to create a fast, static web presence using Hugo, but to engineer a showcase of modern web security by scoring a maximum possible rating on the industry-benchmark Mozilla Observatory: 120 / 100 — Grade A+.

The Security Header Scorecard

Mozilla Observatory evaluates web applications across ten rigorous security criteria. Here is how we engineered each layer to achieve full marks and bonus points:

+-----------------------------------------------------------------------------------------+
|                         Mozilla Observatory 120/100 Scorecard                          |
|                                                                                         |
|  Criteria                                    Score    Result                            |
|  -----------------------------------------   ------   --------------------------------  |
|  Content Security Policy (CSP)                +10     default-src 'none'; strict origin |
|  HTTP Strict Transport Security (HSTS)        +0      max-age=31536000; preload         |
|  X-Frame-Options                              +5      DENY (via frame-ancestors 'none') |
|  X-Content-Type-Options                       +0      nosniff                           |
|  Referrer-Policy                              +5      no-referrer, strict-origin        |
|  Subresource Integrity (SRI)                  +0      SHA-384 hashes on all scripts     |
|  Cross-Origin Resource Sharing (CORS)         +0      Restricted / No wildcard access   |
|  Cookie Security                              +0      No unencrypted or lax cookies     |
|  HTTPS Redirection                            +0      Strict 301 redirection            |
|  Bonus: Advanced CSP & Preload Rules          +100    Maximum possible score            |
|  -----------------------------------------   ------   --------------------------------  |
|  TOTAL SCORE: 120 / 100 (Grade: A+)                                                     |
+-----------------------------------------------------------------------------------------+

Anatomy of a Hardened `_headers` Configuration

Below is the production-grade HTTP security header blueprint deployed via static edge routing:

/*
  # 1. Clickjacking & Frame Defense
  X-Frame-Options: DENY
  
  # 2. Prevent MIME-Type Sniffing
  X-Content-Type-Options: nosniff
  
  # 3. Privacy-Preserving Referrer Policy
  Referrer-Policy: no-referrer, strict-origin-when-cross-origin
  
  # 4. Mandatory HTTPS & HSTS Preloading
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  
  # 5. Zero-Trust Content Security Policy (CSP)
  Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; block-all-mixed-content;
  
  # 6. Hardware & API Feature Restrictions
  Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
  
  # 7. Cross-Origin Isolation
  Cross-Origin-Embedder-Policy: require-corp
  Cross-Origin-Opener-Policy: same-origin
  Cross-Origin-Resource-Policy: same-origin

Deep Dive into the Controls:

default-src 'none' CSP Baseline: By setting the default source to 'none', any resource type not explicitly whitelisted is denied by default. This neutralizes inline script injections, rogue iframes, and unauthorized font/style tracking beacons.
HSTS with Preloading: Setting max-age=31536000 (1 year) with includeSubDomains and submitting the domain to the Chrome/Firefox HSTS Preload List guarantees that browsers will never initiate a plaintext HTTP connection, eliminating SSL-stripping attacks.
Permissions-Policy Perimeter: Disables access to sensitive device APIs (camera, microphone, geolocation, payment request API), preventing compromised third-party scripts from weaponizing browser hardware features.
Cross-Origin Isolation (COEP/COOP): Isolates the browsing context to prevent Spectre-style timing side-channel attacks across tabs.

Conclusion

A static website doesn’t have to be insecure. By combining static site generators with edge-delivered security headers, you eliminate dynamic server-side vulnerabilities while establishing mathematical proof of browser security.

Global Endpoint Transformation: Migrating 5,000 Endpoints to Hardened 64-bit Architecture

Tue, 08 May 2018 16:00:00 +0200

In complex biomedical research environments, legacy operating systems tend to linger far past their shelf life due to entrenched dependencies on specialized scientific software, laboratory instruments, and proprietary data analysis scripts. However, retaining aging Windows XP installations across thousands of workstations creates untenable cybersecurity liabilities: unpatched kernel vulnerabilities, lack of memory layout randomization (ASLR), pervasive administrative privileges, and absence of full-disk encryption.

At the Novartis Institutes for BioMedical Research (NIBR), we executed a comprehensive global transformation program: engineering a modern, hardened 64-bit Windows build and rolling it out across 5,000 client machines across our worldwide research centers.

Overcoming Application Sprawl with Data-Driven Governance

The primary hurdle in enterprise operating system migrations is application compatibility. With over 2,000 diverse scientific applications in active use across research divisions, waiting for every single legacy utility to be re-packaged would have stalled the rollout for years.

To break this gridlock, we pioneered a data-driven Enterprise AppStore:

+-----------------------------------------------------------------------------------------+
|                       Data-Driven Migration & Security Architecture                     |
|                                                                                         |
|  [2,000+ Legacy Scientific Apps] ===> [NIBR AppStore Packaging & Validation Engine]    |
|                                                  |                                      |
|                                                  +---> Compatibility Tier (1-4)         |
|                                                  +---> Security Sandbox / UAC Vetted    |
|                                                  +---> Automated Smoke Tests            |
|                                                  |                                      |
|                                                  v                                      |
|  +-----------------------------------------------------------------------------------+  |
|  | Machine Readiness Assessment Engine (SCCM + Active Inventory Telemetry)          |  |
|  | - Evaluates installed apps on every specific endpoint against AppStore catalog   |  |
|  | - Computes Readiness Score (0-100%)                                               |  |
|  +-----------------------------------------------------------------------------------+  |
|                                                  |                                      |
|                                                  v (Trigger Migration when >= 95%)      |
|  +-----------------------------------------------------------------------------------+  |
|  | Zero-Touch / Lite-Touch Deployment of Hardened 64-bit Windows Build                |  |
|  | * BitLocker Full-Disk Encryption with TPM Hardware Key Protection                 |  |
|  | * Mandatory User Account Control (UAC) - Standard User by Default                 |  |
|  | * ASLR & DEP Kernel Memory Exploitation Protections Active                        |  |
|  | * AppLocker Application Whitelisting & Controlled Execution                       |  |
|  +-----------------------------------------------------------------------------------+  |
+-----------------------------------------------------------------------------------------+

Core Security Safeguards of the New Build

Hardware-Anchored Full-Disk Encryption (BitLocker + TPM): Every machine was provisioned with TPM 1.2/2.0 hardware-backed BitLocker encryption, ensuring physical theft of laptops or desktop hard drives could not lead to data leakage.
Strict Least Privilege (Removal of Local Admin): Enforced standard non-privileged user accounts for day-to-day work, preventing drive-by web malware or compromised email attachments from acquiring kernel-level persistence.
Data Execution Prevention (DEP) & ASLR: Enabled mandatory 64-bit memory protection mechanisms across all binaries, neutralizing classic buffer overflow and return-oriented programming (ROP) exploits.
AppLocker Whitelisting & Software Governance: The AppStore served as a curated, vetted repository. Only signed, approved applications could execute, preventing unauthorized shadow IT utilities and unvetted executables from executing in production networks.

Measurable Results

Accelerated Global Deployment: The dynamic readiness mapping allowed us to commence deployments months ahead of schedule, completing 5,000 endpoints with zero unscheduled downtime for laboratory experiments.
Radical Security Posture Elevation: Eliminated thousands of legacy XP vulnerabilities from the corporate network, dramatically reducing malware infection rates and helpdesk ticket volume.
Lifecycle Governance: Established a repeatable software packaging and lifecycle management framework that streamlined future OS upgrades.

Zero-Trust Mobility: Deploying 2,500 iOS Devices with MDM & Containerized BYOD

Mon, 07 May 2018 15:00:00 +0200

For years, enterprise mobile computing was synonymous with BlackBerry and hardware-tethered BES (BlackBerry Enterprise Server) architectures. While secure for its era, the restrictive ecosystem severely hindered modern research workflows: scientists could not view interactive clinical dashboards, utilize modern messaging tools, or review rich scientific documentation on mobile devices.

At the Novartis Institutes for BioMedical Research (NIBR), we spearheaded the strategic transition from legacy BlackBerry devices to a modern, agile mobile ecosystem: deploying over 2,500 corporate iOS devices and pioneering a secure Bring Your Own Device (BYOD) framework across research operations.

The Mobile Threat Model: Balancing Openness and Data Protection

Allowing employees to access proprietary pharmaceutical data on mobile devices introduced novel security considerations:

Device Loss and Theft: Risk of confidential emails or research attachments being accessed if a device was lost.
Malicious and Unvetted Apps: Risk of consumer apps scraping clipboard contents or accessing local enterprise document caches.
Network Interception: Unsecured public Wi-Fi networks exposing corporate traffic to man-in-the-middle (MITM) inspection.
Privacy in BYOD Scenarios: Enforcing corporate security boundaries without compromising user personal privacy or exposing personal photos/messages to IT administrators.

+-----------------------------------------------------------------------------------------+
|                        Enterprise Mobile Security Architecture                          |
|                                                                                         |
|  [Personal Domain / Consumer Apps]          [Encrypted Enterprise Workspace Sandbox]    |
|  - Personal iCloud Photos / Messages        - Managed Outlook / Teams / Research Apps   |
|  - Consumer Social Media & Games            - Hardware Secure Enclave Cryptography      |
|                                                              |                          |
|  ============================================================|========================  |
|         Open-In Management / Data Leakage Barrier (No Copy/Paste to Personal Apps)      |
|  ============================================================|========================  |
|                                                              v                          |
|                                            +-----------------------------------------+  |
|                                            | Per-App Micro-VPN Tunnel (IKEv2 / IPsec)|  |
|                                            +-----------------------------------------+  |
|                                                              |                          |
|                                                              v                          |
|  +-----------------------------------------------------------------------------------+  |
|  | Enterprise Mobile Device Management (MDM) & Identity Gateway                      |  |
|  | - Remote Selective Wipe (Deletes corporate sandbox while preserving personal data)|  |
|  | - Jailbreak / Root Detection & Instant Compliance Quarantine                      |  |
|  | - Automated PKI Certificate Enrollment (SCEP / EST)                               |  |
|  +-----------------------------------------------------------------------------------+  |
+-----------------------------------------------------------------------------------------+

Security Engineering & Device Architecture

Hardware-Backed Encryption (Secure Enclave): Leveraged Apple’s native Data Protection API, ensuring that files stored within the enterprise sandbox remained encrypted with device-unique hardware keys until authenticated via biometrics (Touch ID / Face ID) or passcode.
Managed Open-In Restrictions: Enforced strict OS-level containerization policies preventing corporate attachments or clipboard contents from being copied or opened in unmanaged consumer applications (e.g., WhatsApp, personal Dropbox).
Per-App Micro-VPNs: Replaced full-device device-level VPNs (which routed all personal traffic through corporate networks) with granular per-app micro-VPN tunnels. Only authenticated enterprise applications could communicate with internal research portals.
Selective Remote Wipe & Compliance Quarantine: In the event of device loss, employee departure, or detection of jailbreaking/compromised OS integrity, administrators could trigger an instantaneous selective wipe that wiped corporate data and credentials in seconds without impacting personal user data.
Automated Over-the-Air SCEP Enrollment: Seamlessly enrolled devices into the corporate PKI via Simple Certificate Enrollment Protocol (SCEP), delivering unique client identity certificates for automatic, secure Wi-Fi and Exchange connectivity.

Outcomes: Secure Productivity Unleashed

The rollout of 2,500 iOS devices and the accompanying BYOD program transformed how researchers communicated and collaborated. Scientists gained instantaneous access to mission-critical information wherever they were, while the enterprise maintained mathematical confidence in the containment and protection of its digital assets.

Hardening macOS in Enterprise Science: Deploying 750 Secure Macs Across 7 Global Sites

Sun, 06 May 2018 14:00:00 +0200

At the Novartis Institutes for BioMedical Research (NIBR), world-class scientists, bioinformaticians, and computational chemists relied heavily on Unix-based computational tools, specialized molecular modeling software, and high-performance developer workflows natively suited to Apple Mac hardware. However, integrating macOS into an enterprise IT landscape predominantly architected for Windows posed formidable security and compliance challenges.

Unmanaged, rogue Mac deployments created severe blind spots: missing disk encryption, inconsistent patch cycles, lack of centralized directory authentication, and unvetted root privileges.

Our objective was clear: engineer a fully managed, hardened macOS enterprise client build that delivered maximum scientific productivity while satisfying strict pharmaceutical security, audit, and GxP compliance standards across 750 Macs deployed in 7 global research sites on 3 continents.

The Endpoint Security Architecture for macOS

To bridge the gap between open scientific computing and stringent enterprise security controls, we implemented a layered endpoint architecture:

+-----------------------------------------------------------------------------------+
|                           Hardened Enterprise macOS Architecture                  |
|                                                                                   |
|  +-----------------------------------------------------------------------------+  |
|  | Hardware & Cryptographic Layer                                              |  |
|  | - FileVault 2 Full-Disk XTS-AES 128/256 Encryption                          |  |
|  | - Institutional Recovery Key (IRK) Escrowed via Hardware Security Module    |  |
|  | - Secure Boot / Firmware Password Enforcement                               |  |
|  +-----------------------------------------------------------------------------+  |
|                                         |                                         |
|                                         v                                         |
|  +-----------------------------------------------------------------------------+  |
|  | Identity & Access Control Layer                                             |  |
|  | - Enterprise Active Directory / Kerberos Single Sign-On (SSO)                |  |
|  | - Standard User by Default (Just-In-Time Privilege Elevation for Scientists)|  |
|  | - 802.1X EAP-TLS Machine & User Certificate Authentication                 |  |
|  +-----------------------------------------------------------------------------+  |
|                                         |                                         |
|                                         v                                         |
|  +-----------------------------------------------------------------------------+  |
|  | Centralized Management & Compliance Enforcement                             |  |
|  | - Automated Jamf Pro / MDM Policy Distribution & Configuration Profiles     |  |
|  | - Automated Security Patching for OS, Safari, and Third-Party Dependencies  |  |
|  | - Endpoint Detection and Response (EDR) Agent & Real-Time SIEM Telemetry    |  |
|  +-----------------------------------------------------------------------------+  |
+-----------------------------------------------------------------------------------+

Core Security Safeguards

Mandatory FileVault 2 Full-Disk Encryption: Guaranteed that all data at rest on scientific laptops and workstations was cryptographically protected. Institutional recovery keys were automatically generated and securely escrowed to support authorized recovery and compliance audits.
Standard User Principle with Controlled Elevation: Scientists operated as standard users by default to mitigate malware persistence and zero-day execution, supported by an automated, audited privilege elevation tool for installing validated scientific packages.
802.1X Certificate-Based Network Access: Integrated Mac endpoints directly into the global enterprise PKI, automatically provisioning X.509 machine certificates for seamless, encrypted Wi-Fi and wired network access without requiring plaintext password broadcasting.
Automated Vulnerability Management & Patching: Configured background caching distribution points across global research hubs to deploy OS updates and critical vulnerability patches rapidly with minimal bandwidth consumption.
Data Loss Prevention & Secure Backup: Integrated enterprise backup solutions that encrypted research data prior to off-site cloud transmission.

Results: Scientific Freedom with Enterprise Assurance

By transforming macOS from an unmanaged fringe device into a first-class, fully audited enterprise citizen, we empowered researchers across Switzerland, the United States, the United Kingdom, and Asia to collaborate freely while protecting invaluable pharmaceutical intellectual property.

Shift Left in IT Operations: Integrating Security and Quality into Front-Line Triage

Sat, 05 May 2018 12:00:00 +0200

In traditional enterprise IT support models, incidents and security alerts follow a sluggish escalation hierarchy: Tier 1 logs the ticket, Tier 2 investigates basic diagnostics, and Tier 3 engineering specialists are finally paged to perform root-cause analysis and remediation. This reactive pipeline is slow, expensive, and fundamentally ill-suited for modern cybersecurity, where every minute an active vulnerability or misconfiguration persists increases breach exposure.

Shift Left is a strategic service transformation that pushes knowledge, diagnostic automation, and security remediation as close to the initial point of contact as possible.

Traditional Support (Escalation Bottleneck)
[User / Alert] ---> [Tier 1: Triage] ---> [Tier 2: Diagnostic] ---> [Tier 3: Engineer / SecOps Fix]
                     (Hours/Days)           (Days/Weeks)              (Costly, Strained Resource)

Shift Left Model (Immediate, Automated Resolution)
[User / Alert] ---> [Self-Service Automation / Tier 1 Armed with Runbooks] ===> [Instant Resolution]
                           |
                           +---> [Tier 3 Focuses on Automated Guardrails & Prevention]

Reversing the Burden of Proof in Service Delivery

At the heart of the Shift Left philosophy is an inversion of proof:

In legacy models, the burden rests on the business customer to report when a service is degraded or non-compliant.
Under Shift Left, the service organization continuously and proactively demonstrates that services meet changing security, compliance, and performance baselines before end users experience friction.

Core Operational and Security Pillars

Codified Security Runbooks: Complex security assessments and standard remediations (e.g., certificate renewals, IAM permission adjustments, suspicious login quarantines) were packaged into automated scripts and clear decision trees for Level 1 support teams.
Secure Offshore Operational Enablement: Established vendor contracts, secure virtual desktop infrastructure (VDI), and rigorous data privacy boundaries to enable an offshore operations team in India to handle 24/7 front-line support safely without exposing core production secrets.
Automated Baseline Verification: Deployed continuous automated checks across servers and endpoints, reporting deviations from security baselines (unpatched packages, disabled firewalls, open ports) directly to Level 1 operators for rapid remediation.
Knowledge Democratization & Self-Healing: Built an interactive knowledge portal and automated self-healing scripts that resolve common user issues (such as password resets, token synchronization, and VPN re-authentication) instantly without human intervention.

Strategic Outcomes

By shifting resolution leftward, our organizations achieved dramatic improvements in agility and security posture:

Drastic Mean Time to Resolution (MTTR) Reduction: Routine security requests and incident tickets that previously took 48+ hours were resolved in under 15 minutes.
Tier 3 Engineering Offload: Freed senior architects and security engineers from repetitive firefighting, allowing them to focus on high-value architecture, threat modeling, and proactive defenses.
Elevated Customer Satisfaction: Business units experienced transparent, predictable IT services with minimal operational friction.

Shift Left transforms IT service delivery from a reactive cost center into an agile, security-first organizational enabler.

Engineering E-Commerce Resilience: Surviving 10x Black Friday Traffic Spikes Securely

Fri, 04 May 2018 11:00:00 +0200

Black Friday represents the highest-revenue event of the year for major retailers—and the ultimate stress test for e-commerce infrastructure. When online traffic surges tenfold in a matter of minutes, traditional monolithic architectures face catastrophic failure modes: database connection exhaustion, cache stampedes, checkout bottlenecks, and heightened exposure to opportunistic cyberattacks including credential stuffing and distributed denial-of-service (DDoS).

For Manor AG’s enterprise SAP Hybris e-commerce platform, our challenge was to architect and execute a dynamic scaling framework that guaranteed 100% availability, sub-second response times, and airtight transaction security throughout the high-intensity Black Friday shopping weekend.

The Dual Imperative: Elastic Scaling & Security Defense

Handling extreme traffic spikes requires optimizing both throughput performance and perimeter defense:

+------------------------------------------------------------------------------------+
|                         High-Resilience E-Commerce Flow                            |
|                                                                                    |
|  [Surging User Traffic + Bot Scanners]                                             |
|         |                                                                          |
|         v                                                                          |
|  +------------------------------------------------------------------------------+  |
|  | Cloudflare Edge & Web Application Firewall (WAF)                             |  |
|  | - Volumetric DDoS Mitigation & Anycast Scrubbing                             |  |
|  | - Advanced Bot Management & Rate Limiting (Preventing Inventory Scraping)   |  |
|  | - Dynamic Queue-it Virtual Waiting Room (Backpressure Control)              |  |
|  +------------------------------------------------------------------------------+  |
|         |                                                                          |
|         v (Clean, Sanitized HTTPS Traffic)                                         |
|  +------------------------------------------------------------------------------+  |
|  | Multi-AZ Elastic Load Balancer (ELB) Layer                                  |  |
|  +------------------------------------------------------------------------------+  |
|         |                                           |                              |
|         v                                           v                              |
|  +-----------------------------+        +---------------------------------------+  |
|  | Auto-Scaled Application Tier|        | High-Performance Edge Caching Layer   |  |
|  | - SAP Hybris JVM Cluster    | <====> | - Distributed Redis / Varnish Caching |  |
|  | - Dynamic CPU/Memory Scaling|        | - Static Asset Offload (>90% Hit Rate)|  |
|  +-----------------------------+        +---------------------------------------+  |
|         |                                                                          |
|         v (Optimized Connection Pool)                                              |
|  +------------------------------------------------------------------------------+  |
|  | Clustered Relational Database Tier (Read Replicas + Write Master)           |  |
|  +------------------------------------------------------------------------------+  |
+------------------------------------------------------------------------------------+

Technical Architecture & Security Safeguards

Defensive Perimeter & Bot Mitigation: Configured intelligent rate limiting and behavioral WAF rules to detect automated inventory-hoarding bots and credential stuffing attempts targeting customer login portals before requests reached application servers.
Backpressure Regulation with Virtual Waiting Rooms: Integrated dynamic virtual queueing mechanisms to gracefully throttle checkout surges, ensuring backend databases operated comfortably within tested throughput limits.
Data-Driven Stress & Chaos Testing: Conducted synthetic load testing simulating 15x normal peak load across critical customer journeys (catalog search, cart additions, payment gateway callbacks), identifying and optimizing slow database queries and JVM memory allocations weeks prior to the event.
Isolated Payment Security: Maintained strict PCI-DSS scope boundaries, ensuring zero sensitive cardholder data touched internal application servers by leveraging tokenized payment gateways with cryptographic validation.
Comprehensive Operational Playbook & War Room: Established continuous cross-functional monitoring involving client executives, software engineers, and hosting operations with pre-scripted mitigation playbooks for every foreseeable anomaly.

Results: Flawless Execution Under Peak Load

The platform processed over 10x regular traffic volume seamlessly:

Zero Downtime: The site maintained 100% availability throughout the entire multi-day promotion.
Performance Consistency: Average page load times remained under 800ms despite record-breaking concurrent shopping sessions.
Security Integrity: Thwarted multiple automated bot attacks and credential scanning attempts without impacting genuine shopper transactions.

By integrating elastic cloud architecture with proactive perimeter security and structured operational playbooks, we turned high-risk peak traffic into a resounding commercial success.

Beyond the Audit: Operationalizing ISO 27001 and 400+ Threat Vectors

Thu, 03 May 2018 10:00:00 +0200

Information security certification is often treated as a superficial check-the-box compliance exercise. However, when an enterprise hosts critical digital commerce platforms, financial portals, and customer data for leading European brands, security must be an active, living operational discipline.

As the sponsor and driver of the ISO 27001 certification program for the Unic Service Business, I directed the strategy, risk modeling, process re-engineering, employee training, and external audit necessary to achieve formal accreditation under ISO/IEC 27001.

Systematic Threat Modeling: Analyzing 400+ Risk Scenarios

Rather than applying generic templates, we conducted a rigorous, bottom-up risk assessment evaluating over 400 distinct threat vectors across infrastructure, software supply chain, personnel, and physical environments:

+-----------------------------------------------------------------------------------------+
|                        ISO 27001 Information Security Architecture                      |
|                                                                                         |
|  +---------------------+    Threat & Vulnerability Analysis     +--------------------+  |
|  | Context & Assets    | -------------------------------------> | 400+ Risk Matrix   |  |
|  | - Web Infrastructure|                                        | - Likelihood (1-5) |  |
|  | - Client Databases  |                                        | - Impact (1-5)     |  |
|  | - CI/CD Pipelines   |                                        | - Risk Score (1-25)|  |
|  +---------------------+                                        +--------------------+  |
|                                                                            |            |
|                                        Risk Treatment & Controls Selection |            |
|                                                                            v            |
|  +-----------------------------------------------------------------------------------+  |
|  | Annex A Security Controls Implementation:                                         |  |
|  | * A.9 Access Control: Zero-trust RBAC, MFA, privileged access management (PAM)    |  |
|  | * A.12 Operations Security: Automated patch management, malware defense, logging |  |
|  | * A.14 System Acquisition & Dev: Static code analysis (SAST), secrets management  |  |
|  | * A.16 Incident Management: Major incident playbooks, tabletop drills             |  |
|  | * A.17 Business Continuity: Redundant multi-region failover, verified backups    |  |
|  +-----------------------------------------------------------------------------------+  |
|                                            |                                            |
|                                            v Continuous Monitoring & Audit              |
|  +-----------------------------------------------------------------------------------+  |
|  | Independent Third-Party Certification (Accredited External Auditors)              |  |
|  +-----------------------------------------------------------------------------------+  |
+-----------------------------------------------------------------------------------------+

Key Operational Transformations

To meet and exceed ISO 27001 standards, we introduced foundational architectural and operational enhancements:

Privileged Access Management & Zero Standing Privileges: Eliminated shared administrative root accounts. All engineer access to production servers was routed through audited bastion hosts requiring session recording and multi-factor authentication.
Deterministic Major Incident Playbooks: Developed comprehensive response workflows for Sev-1 incidents, establishing clear escalation paths, external communication protocols, forensic data preservation, and post-mortem review cycles.
Automated Vulnerability Management: Integrated automated vulnerability scanners into the hosting infrastructure, categorizing CVEs with strict SLA remediation targets based on CVSS severity scores.
Physical & Environmental Security Controls: Audited and enforced strict dual-custody access controls, CCTV monitoring, and power/cooling redundancies across partner data centers.
Secure Software Development Lifecycle (SSDLC): Embedded security checks, dependency scanning, and automated linting directly into GitLab CI/CD build pipelines.

Measurable Business and Operational Impact

Achieving ISO 27001 certification produced lasting strategic advantages for both our organization and our clients:

Customer and Partner Trust: Provided enterprise clients with verifiable, accredited proof that their e-commerce and web platforms adhere to the highest international security standards.
Risk Reduction: Drastically reduced the attack surface and established predictable, rapid containment protocols for potential security events.
System Rationalization: Consolidated redundant legacy hosting tools into a streamlined, audited toolchain—lowering operating costs while boosting uptime.

By framing ISO 27001 as a blueprint for technical excellence rather than a compliance hurdle, we fostered a durable security culture that empowered our teams to deliver resilient digital experiences.

ISO27001

Wed, 02 May 2018 11:37:08 +0200

Unic AG, ISO27001 Certification

Sponsor and driver of process definition, training, assessment and audit to get Unic Service Business ISO27001 certified. This included creating an assessment for more than 400 risks and providing detailed plans to deal with major incidents. The benefits for the organisation and customers included:

Increased reliability and security of systems
Increased profits
Cost-effective and consistent information security
Systems rationalisation
Compliance with legislation
Improved management control
Improved risk management and contingency planning
Enhanced customer and trading partner confidence

Cryptographic Trust at Scale: Deploying e-Seals & Automated S/MIME for 80,000 Users

Wed, 18 Apr 2018 16:00:00 +0200

In regulated industries such as pharmaceuticals and healthcare, sensitive research data, intellectual property, clinical trial results, and legal documents are constantly exchanged with external partners, hospitals, and regulatory bodies. Traditional email protocols transmit messages in plaintext across intermediary mail transfer agents (MTAs), leaving corporate communication vulnerable to eavesdropping, tampering, and spoofing.

As Project Manager and Solution Architect for the e-Seal Project at Novartis International AG, I led the architecture and rollout of an enterprise-grade secure messaging and cryptographic digital sealing infrastructure supporting over 80,000 employees globally.

The Architecture of End-to-End Email Security

Designing a system that balances strict cryptographic guarantees with effortless usability required a multi-layered approach:

+------------------------------------------------------------------------------------+
|                         Enterprise Secure Messaging Flow                           |
|                                                                                    |
|  [Internal Sender]                                                                 |
|         |                                                                          |
|         v (Standard Outlook / Exchange Transmission)                               |
|  +------------------------------------------------------------------------------+  |
|  | Central Secure Messaging Gateway (Policy Engine & DLP Inspection)            |  |
|  | - Classifies sensitivity (Public, Internal, Confidential, Secret)            |  |
|  | - Automatically queries Global Recipient Certificate Directory               |  |
|  +------------------------------------------------------------------------------+  |
|         |                                           |                              |
|         | (Partner has S/MIME certificate)          | (Partner has NO certificate) |
|         v                                           v                              |
|  +-----------------------------+        +---------------------------------------+  |
|  | Cryptographic S/MIME Engine |        | Secure Web Portal & Large File Gateway|  |
|  | - Signs with Corporate Seal |        | - TLS 1.3 Encrypted Portal (2FA/OTP)  |  |
|  | - Encrypts with Public Key  |        | - Time-bound, Encrypted Storage Vault |  |
|  +-----------------------------+        +---------------------------------------+  |
|         |                                           |                              |
|         v                                           v                              |
|  [External Recipient: Decrypts in Inbox]   [External Recipient: Reads via Portal]  |
+------------------------------------------------------------------------------------+

Core System Components:

Automated Gateway e-Seals: Rather than burdening 80,000 individual employees with manually managing recipient public keys, central security gateways automatically apply corporate cryptographic signatures and S/MIME encryption based on classification headers and destination domains.
External Secure Large File Transfer: Standard email attachments fail when handling gigabyte-scale genomic data or high-resolution clinical imaging. We built a dedicated, highly available web portal integrated into the message stream, allowing encrypted, audited transfers with expiration policies.
Multi-Protocol Interface Adapters: Connected internal enterprise applications, legacy ERPs, and automated clinical notification engines into the secure messaging backbone via standardized APIs (REST, SMTP-TLS, and AS2).
Automated Key Discovery & Domain Federation: Implemented DNS-based certificate discovery (CERT records) and automated key exchange agreements with top-tier healthcare and research partners.

Rigorous System Validation & Operational Readiness

Operating in a GxP and strictly regulated pharmaceutical environment meant that validation and compliance were paramount:

Comprehensive Validation Suite: Directed the engineering and QA teams through IQ/OQ/PQ (Installation, Operational, and Performance Qualification) testing to satisfy international regulatory standards (FDA 21 CFR Part 11).
Service Desk Training & Runbooks: Developed intuitive operational runbooks and conducted extensive training for multi-tier global service desks to handle edge cases such as partner certificate expiration or portal authentication resets.
Continuous Monitoring & Anomaly Detection: Integrated gateway telemetry into corporate SIEM pipelines to alert on anomalous data exfiltration volumes and brute-force portal access attempts.

The e-Seal solution transformed enterprise email from a vulnerable communication channel into a trusted, encrypted, and legally compliant exchange mechanism across the global healthcare ecosystem.

Zorig

Wed, 18 Apr 2018 09:00:27 +0200

Using hugo static site generator and netlify continuous integration (from github), I created a small static website for a local business. I also wanted to make sure, the site is secure and get’s the highest score on Mozilla observatory:

Score	Rule	Description
0	x-xss-protection	X-XSS-Protection header set to “1; mode=block”.
0	cookies	No cookies detected.
0	cross-origin-resource-sharing	Content is not visible via cross-origin resource sharing (CORS) files or headers.
0	public-key-pinning	HTTP Public Key Pinning (HPKP) header not implemented.
0	redirection	Initial redirection is to https on same host, final destination is https.
0	contribute	Contribute.json isn’t required on websites that don’t belong to Mozilla.
0	strict-transport-security	HTTP Strict Transport Security (HSTS) header set to a minimum of six months (15768000).
0	subresource-integrity	Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin.
0	x-content-type-options	X-Content-Type-Options header set to “nosniff”.
5	referrer-policy	Referrer-Policy header set to “no-referrer”, “same-origin”, “strict-origin” or “strict-origin-when-cross-origin”.
5	x-frame-options	X-Frame-Options (XFO) implemented via the CSP frame-ancestors directive.
10	content-security-policy	Content Security Policy (CSP) implemented with default-src ’none’ and no ‘unsafe’.

The final score is a personal record of: 120 - Grade: A+

Full Report Url: https://observatory.mozilla.org/analyze.html?host=zorig.ch

Scaling Enterprise PKI: From Manual Certificate Chaos to Automated Registration Authorities

Mon, 16 Apr 2018 14:00:00 +0200

In a global enterprise operating across research institutes, manufacturing sites, and clinical trials, Public Key Infrastructure (PKI) forms the bedrock of digital trust. Digital signatures, secure email (S/MIME), device identity certificates, code signing, and internal TLS encryption all rely on the integrity of the underlying Certificate Authorities (CAs).

During the Global PKI v2 initiative at Novartis International AG, we tackled the challenge of transforming a legacy, manual certificate provisioning process into an automated, web-based Registration Agency (RA) system capable of serving tens of thousands of scientists, engineers, and operational devices globally.

The Pitfalls of Legacy Enterprise PKI

Prior to PKI v2, global certificate operations faced systemic operational and security friction:

Manual Verification Bottlenecks: Requesting user and server certificates required lengthy ticket-based approvals and manual identity vetting by central cryptographic administrators.
Risky Private Key Generation: Users occasionally generated CSRs on untrusted endpoints with suboptimal key lengths or unvetted cryptographic algorithms.
High Outage Risk from Manual Lifecycles: Without centralized lifecycle visibility, expiring certificates frequently led to unexpected service disruptions and broken API integrations.
Complex Disaster Recovery & Key Escrow: Legacy systems lacked streamlined key recovery procedures for encrypted data, creating potential data-loss risks if user smart cards were corrupted.

Technical Architecture of the Web-Based Registration Agency

The PKI v2 transformation centered on decoupling root and intermediate Certificate Authorities from day-to-day user interactions through a secure, multi-tier Web Registration Agency:

+-----------------------------------------------------------------------------------------+
|                               Global Enterprise PKI Architecture                         |
|                                                                                         |
|  +--------------------+        mTLS + RBAC          +--------------------------------+  |
|  | Local IT Officer / | --------------------------> | Web-Based Registration Agency  |  |
|  | Automated Workload |                             | (RA Engine / Validation Logic) |  |
|  +--------------------+                             +--------------------------------+  |
|                                                                    |                    |
|                                                      Cryptographic Protocol (CMP / CMC) |
|                                                                    v                    |
|  +-----------------------------------------------------------------------------------+  |
|  | Hardened HSM-Backed Issuing Intermediate CA (Entrust Authority Security Core)      |  |
|  | - FIPS 140-2 Level 3 Hardware Security Modules                                    |  |
|  | - Automated Certificate Revocation Lists (CRL) & High-Availability OCSP Responders|  |
|  +-----------------------------------------------------------------------------------+  |
|                                            ^                                            |
|                                            | Air-Gapped Trust Chain                     |
|  +-----------------------------------------------------------------------------------+  |
|  | Air-Gapped Offline Root Certificate Authority                                     |  |
|  +-----------------------------------------------------------------------------------+  |
+-----------------------------------------------------------------------------------------+

Key Security Implementations:

FIPS 140-2 Level 3 Hardware Security Modules (HSMs): All CA private keys were secured within dedicated physical HSMs, guaranteeing that private signing keys could never be exported in plaintext.
Automated Verification Engine: The new web-based RA integrated directly with enterprise directory services (LDAP/Active Directory), verifying user employment status, department authorizations, and cryptographic privilege levels in real time.
Engine-Level Template Enforcement: Standardized cryptographic policies enforced minimum 2048-bit RSA / ECC key sizes, SHA-256 hashing algorithms, and strict X.509 v3 Key Usage / Extended Key Usage extensions.
Automated High-Performance OCSP Responders: Replaced cumbersome, heavy CRL distribution points with lightweight Online Certificate Status Protocol (OCSP) responders to ensure instant revocation checks across global network perimeters.

Global Enablement & Operational Transition

Technology alone does not guarantee security; organizational readiness is equally crucial. We designed and delivered hands-on training programs for local IT support teams across all global regions (Europe, Americas, Asia-Pacific). This empowered local teams to safely execute authorized identity verifications while adhering to strict corporate Certificate Practice Statements (CPS).

By transitioning PKI from an isolated project into an enterprise operational service, we delivered high-assurance digital identities with zero downtime and established a secure foundation for enterprise-wide e-seals and S/MIME encryption.

Modernizing Enterprise Credential Management: Zero-Knowledge Architecture & Identity Governance

Sun, 15 Apr 2018 10:00:00 +0200

In modern distributed enterprises, compromised credentials remain the single most common initial attack vector in data breaches. Legacy password solutions often suffer from severe structural deficiencies: fragmented local desktop databases, lack of centralized revocation, unmonitored plaintext exports, and widespread sharing of administrative credentials over unencrypted channels.

When modernizing the password management infrastructure at Unic, our mission was clear: eliminate password reuse and unsecured credential sharing while instituting strict zero-knowledge security and comprehensive audit logging.

The Security Challenges of Legacy Credential Stores

Our legacy system (Password Manager XP) presented several critical risk vectors:

Lack of Zero-Knowledge Encryption: Centralized databases where decryption keys could potentially be intercepted or mishandled during synchronization.
Coarse-Grained Access Control: Inability to enforce strict role-based access control (RBAC) across distinct Business Units (BUs) and client delivery teams.
Absence of Real-Time Audit Trails: No verifiable logging of who accessed specific client production API keys or administrative root passwords.
Friction-Driven Workarounds: Cumbersome UX led engineers and consultants to cache credentials in local text files or unencrypted browser storage.

+-----------------------------------------------------------------------------------+
|                        Zero-Knowledge Enterprise Vault                            |
|                                                                                   |
|  +--------------------+     Master Password + Secret Key    +------------------+  |
|  | Client Device /    | ----------------------------------> | Client-Side      |  |
|  | Browser Extension  | <---------------------------------- | AES-256 GCM      |  |
|  +--------------------+      Encrypted Ciphertext Only      +------------------+  |
|            |                                                         |            |
|            v TLS 1.3 Secure Enclave Tunnel                           v            |
|  +--------------------+     Encrypted Vault Storage         +------------------+  |
|  | Cloud Platform /   | ==================================> | Zero-Knowledge   |  |
|  | Identity Provider  |                                     | Encrypted Blobs  |  |
|  +--------------------+                                     +------------------+  |
|            |                                                                      |
|            +--------> Immutable SIEM Audit Logs & Anomaly Detection               |
+-----------------------------------------------------------------------------------+

Architectural Blueprint & Security Safeguards

To address these vulnerabilities, we migrated to a modern cloud-native secrets platform built on zero-knowledge encryption principles:

Dual-Key Client-Side Cryptography: Every vault item is encrypted and decrypted exclusively on the client endpoint using AES-256 in GCM mode, derived from a combination of the user’s master password and a high-entropy 128-bit Account Secret Key. The hosting infrastructure never receives or stores plaintext credentials or master keys.
Vault Segmentation & Principle of Least Privilege: Each Business Unit operates within dedicated, cryptographically isolated vaults. Sensitive production infrastructure keys are partitioned from day-to-day application logins.
Separation of Enterprise and Personal Secrets: Clear policy segregation ensures that corporate secrets remain auditable and transferable upon employee offboarding, while personal credentials remain private to the user.
Native Browser & CLI Integration: By providing seamless autofill with phishing protection (verifying exact domain FQDNs before presenting credentials), we neutralized credential-harvesting phishing campaigns.
Automated Audit Logging & SIEM Ingestion: Real-time events for credential reads, permission modifications, and unusual geographic logins are continuously streamed into centralized monitoring systems.

Business Unit Clean-up & Migration Strategy

A security tool is only as effective as the data hygiene behind it. We appointed dedicated Security Champions across every Business Unit to conduct structured audits:

Deprecating stale accounts and cycling all shared client production passwords during ingestion.
Enforcing Mandatory Multi-Factor Authentication (MFA) via FIDO2 WebAuthn hardware security keys.
Preparing the platform for guest and external contractor access, enforcing time-bound, read-only credential delegation without disclosing underlying master passphrases.

By prioritizing usability alongside uncompromising cryptographic architecture, we achieved 100% organizational adoption, eliminated unmanaged password repositories, and established a scalable foundation for zero-trust identity management.

iOS

Sat, 14 Apr 2018 20:14:03 +0200

NIBR: Deployment of 2'500 iOS devices

Mobile Client services using Blackberries were outdated. Our users wanted to use iPhones, iPads and Android devices. We’ve created a service to manage mobile devices:

Deployment of 2'500 iOS devices
Launch Bring your own device (BYOD) pilot for iOS and Android
Set up of an iOS device management service

Password Manager

Sat, 14 Apr 2018 20:08:54 +0200

Unic: Introduction of new password manager

We successfully replaced our legacy Password Manager XP with a fast, web-based platform featuring native browser integration and robust audit logging. Designed strictly for personal business secrets—keeping private user data separate—the new system has significantly elevated enterprise security while streamlining daily workflows. To ensure a smooth transition, legacy credentials were imported directly into the new platform. Dedicated points of contact in each Business Unit (BU) led a targeted cleanup of outdated data, empowering BUs to design customized folder structures aligned with their unique operational needs.

The rollout dramatically improved employee productivity, data hygiene, and compliance across the organization. Building on this success, the platform is positioned for its next phase: extending secure, controlled credential access to external partners and clients.

e-Seal

Tue, 10 Apr 2018 22:04:50 +0200

Novartis International AG, e-Seal Project

Project Manager & Solution Architect - Implementation of secure e-mail with external partners for 80’000 users, including: System design and architecture, incl. external website for large file transfer, central messaging system and various interfaces

System validation - Team lead for testing and engineering
Training of service desks
Managing system enhancement

PKI v2

Tue, 10 Apr 2018 22:00:05 +0200

Novartis International AG, Global PKI Project: Project Manager PKI V2

Designed and implemented a web-based Registration Agency System.
Successfully upgraded the existing PKI to support ENGINE and the web-based RA.
Trained local IT support in PKI globally.
Supported the transition of PKI from Project to operational Organization.

HSTS - How to implement HTTP Strict Transport Security (HSTS)

Tue, 10 Apr 2018 18:03:15 +0200

Please find my latest blog post how to implement HSTS here: https://wiedemeier.space/blog/hsts/

Time to finally implement TLS everywhere

Tue, 03 Oct 2017 21:33:00 +0200

This blog was previously posted here: https://www.unic.com/en/competencies/experts-blog/2017/website-available-through-tls but has since been deleted.

Google Chrome – with a market share of 60% the currently most used web browser [^1] – will mark user entry on HTTP-pages as “Not Secure” from version 62 onwards (due October 2017). [^2]

It is a stated goal of the Chromium project (the open source community developing the Chrome browser) to mark all HTTP pages as “Not secure” in Chrome [^3]:

What is Transport Layer Security?

Transport Layer Security (short: TLS, formerly known as Secure sockets layer (SSL)) are cryptographic protocols that

“provide communications security over a computer network. Several versions of the protocols find widespread use in applications such as web browsing, email, Internet faxing, instant messaging, and voice-over-IP (VoIP). Websites use TLS to secure all communications between their servers and web browsers.” [^4]

“The Transport Layer Security protocol aims primarily to provide privacy and data integrity between two communicating computer applications. When secured by TLS, connections between a client (e.g., a web browser) and a server (e.g., wikipedia.org) have one or more of the following properties:

The connection is private (or secure) because symmetric cryptography is used to encrypt the data transmitted. The keys for this symmetric encryption are generated uniquely for each connection and are based on a shared secret negotiated at the start of the session […]. The identity of the communicating parties can be authenticated using public-key cryptography. This authentication can be made optional but is generally required for at least one of the parties (typically the server).

The connection ensures integrity because each message transmitted includes a message integrity check using a message authentication code to prevent undetected loss or alteration of the data during transmission.” [^4]

In the past, using TLS was prohibitive due to the complex installation of expensive certificates and limited compute power to encrypt all traffic. Many websites thus implemented TLS only on sensitive pages, such as login forms. However, since a couple of years, TLS is used on more and more web pages and has become a must- have. Certificates are available from multiple sources (even for free) with plenty of information how to install and use them. The benefits for TLS-enabling a website are:

Clear signal to users that a company takes data privacy and protection seriously - even if there is only a low risk of data exposed.
TLS is good for page ranking (search engine optimisation - SEO). We don’t know how big the impact on ranking is when a site has TLS (in 2014, Google said that it is a “lightweight signal” [^5]). But it is a ranking signal. Therefore, as markets get more and more competitive, everything that helps websites to get better rankings should be done.The green symbol in the browser bar helps to prevent users from bouncing back to the search engine results page. Therefore, you get a positive user signal which is very helpful.
This - in turn - helps you gain users trust.

HTTP/2

TLS is also a pre-requisite to support (yet) another new protocol: HTTP/2 - a major revision of the 15-year old HTTP/1.x protocol. At a high level, HTTP/2:

is binary, instead of textual
is fully multiplexed, instead of ordered and blocking
can, therefore, use one connection for parallelism
uses header compression to reduce overhead
allows servers to “push” responses proactively into client caches

“Although the standard itself does not require use of encryption, most client implementations (Firefox, Chrome, Safari, Opera, Internet Explorer, Edge) have stated that they will only support HTTP/2 over TLS, which makes encryption de facto mandatory.” [^6]

Summary

So, to summarise: Using TLS on your website makes your page

Trustworthy
Responsible
Better ranked in Google
Future-proof for modern browsers and HTTP/2

We’re happy to help make your web property trustworthy and future proof - please contact us today!

Once TLS is completely implemented, we recommend to set HSTS headers to further improve the security of your website.

[^1] https://www.netmarketshare.com/browser-market-share.aspx? qprid=0&qpcustomd=0

[^2] https://security.googleblog.com/2017/04/next-steps-toward-more- connection.html

[^3] https://www.chromium.org/Home/chromium-security/marking-http-as-non- secure

[^4] https://en.wikipedia.org/wiki/Transport_Layer_Security

[^5] https://webmasters.googleblog.com/2014/08/https-as-ranking-signal.html

[^6] https://en.wikipedia.org/wiki/HTTP/2