Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Certificate Authorities Form Group to Educate on SSL Best Practices

But in the past several years, CAs like RSA, DigiNotar and Comodo have been the victims of breaches that potentially allowed hackers to create their own fraudulent certificates. Last week, a banking Trojan was found in the wild with a valid digital certificate purchased from a CA using a fraudulent identity.

The problem is not an academic one. Last week, security firm Bit9 disclosed that hackers had penetrated its network, gained access to several of its digital certificates and used them to masquerade as Bit9 to install malware on the systems of three of Bit9's customers.

Responding to these increasing threats-sophisticated hacker networks, global cybercriminal organizations and state-sponsored espionage-seven global CAs came together on Thursday to form the Certificate Authority Security Council (CASC), an advocacy group aimed promoting best practices to advance the security of websites and online transactions. The CAs include Comodo, DigiCert, Entrust, GlobalSign, Go Daddy, Symantec and Trend Micro. Together they represent 95 percent of all certificates issued, says Kirk Hall, operations director for Trust Services at Trend Micro.

"There have been increased threats against CAs in the past several years," says Hall. "There was room for us to do more working together as CAs."

"There's a surprising amount of things that we can do with users and others involved in deploying certificates that can make the system much stronger," he adds.

CASC Will Start by Promoting OCSP Stapling

CASC's first initiative will be a series of educational and advocacy efforts related to best practices in SSL deployment, particularly online certificate status checking and revocation.

"If we look at the SSL ecosystem as it exists today, there's a few things that could be better," says Ryan Hurst, CTO of GlobalSign. "SSL isn't deployed as widely as everyone would like. And even people that deploy SSL only deploy it on a portion of their sites because they're concerned about performance."

For that reason, the first initiative will highlight the benefits of Online Certificate Status Protocol (OCSP) stapling to web server administrators, software vendors, browser developers and end users. OCSP stapling is an alternative approach to OCSP, which is used to check the revocation status of X.509 certificates. OCSP is often seen as the culprit behind the performance hits that Hurst says prevents people from deploying SSL more broadly.

"OCSP stapling actually goes a long way toward reducing the performance tax associated with performing that check and thus speeds up SSL," Hurst says.

Hurst notes that advocating best practices around code signing is likely to be a future initiative of CASC.

"This is just the first of many projects that we as a group will work on together," Hurst says.

Thor Olavsrud covers IT Security, Big Data, Open Source, Microsoft Tools and Servers for CIO.com. Follow Thor on Twitter @ThorOlavsrud. Follow everything from CIO.com on Twitter @CIOonline, Facebook, Google + and LinkedIn. Email Thor at tolavsrud@cio.com

Read more about network security in CIO's Network Security Drilldown.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: Comodo, Entrust, Facebook, GlobalSign, Google, IT Security, Microsoft, RSA, Symantec, Trend Micro
Comments are now closed.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: Network | Network Security, certificate authority, Web of Trust, Comodo, Networking, Digital Certificate, SSL, network, DigiNotar, symantec, Trusted Transactions, Bit9, security, trend micro, Go Daddy, encryption
Latest Blog Posts
Whitepapers
  • IDC MarketScape Excerpt: Worldwide Client Virtualization Software Assessment
    The rise of BYOD is creating governance and regulatory nightmares while providing end users with unprecedented flexibility and agility. While IT is still intrigued by the possibility of a better desktop management model and the operational savings client virtualization software could deliver, it is the increased governance and the ability to deliver desktops, applications, and data to any device that are driving today's purchases.
    Learn more »
  • Why you should be re-thinking your approach to data protection
    Organisations of all shapes and sizes need a new approach to data protection that addresses the challenges of data growth, but IT budgets are not keeping pace with the escalating costs of supporting storage requirements. This whitepaper explores how securing and retrieving organisational data will need to be done more efficiently.
    Learn more »
  • Guide: 10 Essential Questions about Mobile App Containers
    Mobile apps are the ultimate corporate dilemma: They turbo-charge productivity—but also bring significant security risks. How do you navigate the challenge and emerge with both? With a comprehensive approach to security.Learn the key areas to focus on as you build a mobile app security strategy.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Salary Calculator

Supplied by

View the full Peoplebank ICT Salary & Employment Index

Recent comments