Certificate Authorities Form Group to Educate on SSL Best Practices
- 15 February, 2013 17:45
But in the past several years, CAs like RSA, DigiNotar and Comodo have been the victims of breaches that potentially allowed hackers to create their own fraudulent certificates. Last week, a banking Trojan was found in the wild with a valid digital certificate purchased from a CA using a fraudulent identity.
The problem is not an academic one. Last week, security firm Bit9 disclosed that hackers had penetrated its network, gained access to several of its digital certificates and used them to masquerade as Bit9 to install malware on the systems of three of Bit9's customers.
Responding to these increasing threats-sophisticated hacker networks, global cybercriminal organizations and state-sponsored espionage-seven global CAs came together on Thursday to form the Certificate Authority Security Council (CASC), an advocacy group aimed promoting best practices to advance the security of websites and online transactions. The CAs include Comodo, DigiCert, Entrust, GlobalSign, Go Daddy, Symantec and Trend Micro. Together they represent 95 percent of all certificates issued, says Kirk Hall, operations director for Trust Services at Trend Micro.
"There have been increased threats against CAs in the past several years," says Hall. "There was room for us to do more working together as CAs."
"There's a surprising amount of things that we can do with users and others involved in deploying certificates that can make the system much stronger," he adds.
CASC Will Start by Promoting OCSP Stapling
CASC's first initiative will be a series of educational and advocacy efforts related to best practices in SSL deployment, particularly online certificate status checking and revocation.
"If we look at the SSL ecosystem as it exists today, there's a few things that could be better," says Ryan Hurst, CTO of GlobalSign. "SSL isn't deployed as widely as everyone would like. And even people that deploy SSL only deploy it on a portion of their sites because they're concerned about performance."
For that reason, the first initiative will highlight the benefits of Online Certificate Status Protocol (OCSP) stapling to web server administrators, software vendors, browser developers and end users. OCSP stapling is an alternative approach to OCSP, which is used to check the revocation status of X.509 certificates. OCSP is often seen as the culprit behind the performance hits that Hurst says prevents people from deploying SSL more broadly.
"OCSP stapling actually goes a long way toward reducing the performance tax associated with performing that check and thus speeds up SSL," Hurst says.
Hurst notes that advocating best practices around code signing is likely to be a future initiative of CASC.
"This is just the first of many projects that we as a group will work on together," Hurst says.
Thor Olavsrud covers IT Security, Big Data, Open Source, Microsoft Tools and Servers for CIO.com. Follow Thor on Twitter @ThorOlavsrud. Follow everything from CIO.com on Twitter @CIOonline, Facebook, Google + and LinkedIn. Email Thor at firstname.lastname@example.org
Read more about network security in CIO's Network Security Drilldown.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
Cloud debate now about speed and sophistication
Yahoo Mail still down for some users, after an attempted fix
Queensland government to provide 200 services online by 2015
CIOs need to get their house in order, CFO panel says
Is Data Complexity Blinding Your IT Decision-Making?
Multi-Factor Authentication; Current Usage and Trends
In this digital age, validating identities and controlling access is vital, which is why multifactor authentication has become such a fundamental requirement in so many organisations. This survey looks at the authentication landscape in Europe, the Middle East, and Africa, and offers insights into how it is expected to change in the coming years.
Building a Strategic Archive
For years, most companies have dealt with the evolving dynamics of data archiving by addressing an immediate need rather than building a long-term strategy. But over time, putting all information on costly storage is likely to be very expensive. This whitepaper explains why it’s time for organizations to start to strategically evaluate archive solutions for capabilities they need, both now and in the future. While no technology is future proof, an archiving solution can make you “future ready.”
Benefits of Web Self-Service
According to Forrester, 72 per cent of customers prefer using a company’s website to answer their questions. But only 52.4 per cent actually find the information they need online. Customers want to solve their issues quickly and easily, and providing the right solutions means greater customer retention and revenue streams - but this is sometimes not the case. Download to find out more.