Running Content Security Policy as a program across Aurelia Travel Group's 140 web properties, climbing the policy staircase of eight steps — inventory, architecture, telemetry, third-party scripts, enforcement, headers and Trusted Types, exceptions and metrics — with enforcement lit; before, a CSP left in report-only for two years generating 40 million ignored reports a month, an unsafe-inline host allowlist, 38 unknown scripts on checkout and a card skimmer at the Voyantis subsidiary; after, a strict nonce policy, checkout cut to 19 governed scripts each with an integrity method, enforcement on 118 of 140 properties, a seven-minute canary rollback and PCI DSS evidence on demand.

CY-EXPERT-036Expert Level · Web Security

Content Security Policy Program Optimisation — The Policy Staircase

An expert-level course that runs Content Security Policy as a portfolio-wide program rather than a per-app header. Climb the policy staircase - eight steps from a flawed baseline to measured assurance: portfolio inventory and threat model; strict policy architecture with nonces, hashes, and 'strict-dynamic'; report-only rollout with telemetry that turns forty million reports into signal; third-party, tag-manager, and framework governance; enforcement with canaries, CI gates, synthetics, and breakage budgets; complementary headers and Trusted Types; exceptions, legacy, and risk acceptance; and metrics, PCI DSS 4.0 evidence, and program optimisation - across 140 properties at Aurelia Travel Group, building one capstone Program Pack component per chapter. Four hands-on activities in every lesson.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Build a reconciled property and per-page script inventory, model XSS and skimming precisely, and prioritise by PCI DSS 4.0 obligation and PII exposure.
Design strict CSP templates with per-response nonces, build-time hashes, 'strict-dynamic', and the 'none' directives, fitted to SSR, SPA, and CDN-cached frameworks.
Run report-only rollout with a Reporting API pipeline that filters, deduplicates, samples, and charts by page class, exiting on zero unassigned violations.
Govern tag managers and vendor scripts with nonce propagation, container policy, SRI and hash-drift monitoring, PSP isolation, an approval SLA, and unexpected-source alerts.

Price:৳12,000