Bram Bonné was awarded the Luciad Master Thesis price 2011

Bram Bonné was awarded the Luciad Master Thesis price 2011 for his master thesis titled "Improving session security in web applications".
Bram received this award from the business representatives during the official proclamation of the Faculty of Engineering on July 8, 2011. For Luciad, the prize was handed out by Frank Suykens, head of product development at Luciad. proud of the winners for the price of

The thesis studied the security of session management in nowadays web applications and improved upon the state-of-the-art by proposing and developing a novel client-side countermeasure against session fixation and hijacking.
The thesis contributes in two important areas. The first contribution is an analysis of the security issues in web session management, and surveying the existing client-side and server-side mitigation techniques. Web session vulnerabilities have been an important attack vector in web applications in the past decade, and are today still in the top 3 web security issues (OWASP Top 10 2010). Although good server-side mitigation techniques exist, in practice most web applications still remain vulnerable. For this reason, Bram also focused on client-side mitigation techniques to allow an end-user to protect himself especially in case server-side protection mechanisms are not in place.

In a second contribution, Bram designed and developed NoFix, a novel client-side mitigation technique against session fixation. This contribution started from a clear identification of the session fixation/hijacking problem as part of the survey, and inspired Bram to devise a simple and clever security policy to differentiate malicious and legitimate access to session management data. He implemented his technique as an extension to Mozilla Firefox. As part of the evaluation, he studied the performance impact on the Alexa top 1000 websites, and evaluated the usability of his countermeasure in a 20-week field experiment.