Cryptography in transit

[vanderaj]

Issue: the crypo in transit chapter is practically impossible to verify. It's very old school J2EE centric, which doesn't help modern applications.

Solution:

Use the SSL/TLS threat model and best practice guides from Mozilla, Microsoft and Qualys to ensure that we have a reasonable set of controls, with adequate guideance to test these empirically from either a configuration or code point of view, as well as a simple set of references for developers to follow that will end up with a reasonable outcome from an ASVS assessment.

Platform issues such as certificate pinning and so on should be considered, but only to note that this should be a platform issue, rather than a developer temporary fix.

[vanderaj]

Fixed with a major update.