Category: Featured

  • Top Security Tools for eCommerce Websites

    As eCommerce websites continue to grow in popularity, so do the risks associated with online transactions. Cybersecurity threats such as hacking, phishing, and identity theft pose significant risks to both the website owners and their customers. In response to these threats, a variety of security tools have been developed to help protect eCommerce websites. Here are some of the top security tools for eCommerce websites:

    • SSL (Secure Sockets Layer): SSL is a standard security protocol that enables encrypted communication between a web server and a browser. It provides an additional layer of security by encrypting sensitive data, such as credit card information, during transmission. SSL certificates can also help to improve a website’s search engine ranking.
    • SiteLock: SiteLock is a cloud-based security tool that offers protection against malware, hacking, and other security threats. It scans websites for vulnerabilities and automatically removes malware, providing continuous protection for eCommerce websites.
    • CodeGuard: CodeGuard is a backup and restore service that protects websites from data loss and corruption. It automatically backs up websites and provides easy restore options in case of data loss, hacking, or accidental deletion.
    • TrustedSite: TrustedSite is a security certification service that verifies the security and trustworthiness of eCommerce websites. It provides a trust seal that can be displayed on the website to assure customers that the website is safe and secure.

    Other notable security tools for eCommerce websites include payment gateways such as PayPal, 2Checkout, and Stripe. These payment gateways offer additional layers of security, such as fraud detection and prevention, to protect both the website owner and their customers.

    It is important to note that no security tool can guarantee 100% protection against cybersecurity threats. However, using a combination of security tools can significantly reduce the risks associated with eCommerce transactions.

  • Securing Your Code with Code Signing SSL: A Guide to Installation on Linux Apache Server

    Code Signing SSL is a digital certificate that is used to sign software code and scripts to ensure their integrity and authenticity. When a code signing certificate is installed, it adds a digital signature to the code, which verifies that it came from the original author and has not been tampered with in any way. This helps to protect users from malware and other malicious software that may be distributed under the guise of legitimate applications.

    In this blog post, we will walk you through the installation process of Code Signing SSL on a Linux Apache server.

    Step 1: Purchase a Code Signing SSL certificate

    The first step is to purchase a Code Signing SSL certificate from a trusted Certificate Authority (CA). There are many CAs available, such as Comodo, DigiCert, and Sectigo. When choosing a CA, make sure to select a reputable one that is recognized by popular web browsers.

    Step 2: Generate a Certificate Signing Request (CSR)

    Once you have purchased a Code Signing SSL certificate, you will need to generate a Certificate Signing Request (CSR) on your Apache server. You can do this using the following command:

    openssl req -new -newkey rsa:2048 -nodes -keyout mykey.key -out mycsr.csr

    Make sure to replace mykey.key and mycsr.csr with the file names you want to use.

    You will then be prompted to enter information about your organization, such as its name and location. Be sure to enter accurate information as it will be used to verify your identity.

    Step 3: Submit your CSR to the CA

    Once you have generated your CSR, you will need to submit it to the CA to obtain your Code Signing SSL certificate. The process for doing this will vary depending on the CA you have chosen, but typically involves uploading your CSR to their website and completing a verification process.

    Step 4: Install your Code Signing SSL certificate

    Once you have received your Code Signing SSL certificate from the CA, you can install it on your Apache server. To do this, follow these steps:

    Create a directory to store your SSL certificates:

    mkdir /etc/ssl/certs

    Copy your SSL certificate to the new directory:

    cp your_certificate.crt /etc/ssl/certs/

    Create a file to store your SSL private key:

    sudo nano /etc/ssl/private/your_domain.key

    Paste your private key into the file and save it.

    Configure your Apache virtual host to use SSL:

    <VirtualHost *:443>
    ServerName yourdomain.com
    DocumentRoot /var/www/html
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/your_certificate.crt
    SSLCertificateKeyFile /etc/ssl/private/your_domain.key
    </VirtualHost>

    Make sure to replace yourdomain.com with your actual domain name, and /var/www/html with the path to your website’s root directory.

    Restart Apache to apply the changes:

    sudo systemctl restart apache2

    Congratulations! You have successfully installed your Code Signing SSL certificate on your Linux Apache server. Your code will now be signed with a digital signature, ensuring its authenticity and integrity.

  • The Rise of Zero Trust: Threats Are No Longer Perimeter-Only Concerns

    The zero-trust strategy approaches security from the mindset that no one — not even your internal network users — can or should be trusted automatically. Here’s why zero trust security is picking up traction with organizations and governments globally…

    … It’s not paranoia when someone really is out to get you. And if you’re an organization or business, you can virtually guarantee that someone, somewhere has you in their crosshairs. Verizon reports 82% of data breaches involve the “human element” — including everything from phishing and social attacks to general errors and misuse — so, it’s clear why all organizations need to change how they approach cyber security.

    This is why the U.S. Department of Defense published information regarding plans to shift its network to a “zero trust architecture” by 2027. In its Zero Trust Strategy and Roadmap document, the federal defense agency shared its goals about what it aims to achieve and what its vision is for the future: implementing stronger defenses against cyber attacks via a dynamic and adaptive approach (zero trust).

    This move toward zero trust security has been picking up traction with businesses and other organizations globally over the past several years. It contrasts the traditional notion that cyber security efforts should focus on external threats and hardening your perimeter defenses to protect against threats outside your network. Imagine the cyber security incidents (and resulting data breaches) that could have been avoided if the targeted organizations had implemented zero trust:

    But what is zero trust and why is it something that can benefit organizations and businesses across all sectors (not just the DoD)?

    Let’s hash it out.

    Zero trust is an organization’s answer to the childhood warning “stranger danger!” It’s both a framework and strategy that operates with the understanding that no one — not you, your devices, your apps, or even your CEO — can (or should) be trusted automatically. And it’s nothing personal — it’s not because your IT admin doesn’t like you. This real-time security strategy approaches cyber security from the perspective that everyone inside and outside your network is a potential threat.

    Zero trust touches everything relating to your IT ecosystem and everything that goes on in the background. It promotes the idea that there are no traditional network boundaries; your assets and resources can be anywhere — on prem, in the cloud, or a mix of both. This makes it a versatile approach to hardening your cyber defenses. Therefore, everyone with access to your organization’s network or IT resources must have their identities continuously vetted throughout their connections.

    Regardless of where your assets are that you want to secure, there are three guiding principles at the heart of zero trust security:

    1. Never Trust, Always Verify

    What we mean by this is that users need to authenticate in a verifiable name. Simply taking them at their word just won’t cut it. This entails using setting default-deny policies, setting least access privileges, and using public key infrastructure (PKI) based tools (such as client authentication certificates).

    Whenever someone logs in or tries to access something in a zero trust environment, they’ll need to continually authenticate (prove their identity) throughout the session. Why? Because session IDs can be hijacked and someone unintended can take over a connection. By implementing comprehensive identity and access management, you’re reducing the potential harm an account compromise could cause.

    Manage Digital Certificates like a Boss

    14 Certificate Management Best Practices to keep your organization running, secure and fully-compliant.

    2. Assume a Hostile Environment or That a Breach Has Occurred

    With zero trust, you assume the worst (someone bad is already in your network) but hope for the best. You’ll want to assume that every network connection and access request is from an attacker. This involves monitoring all users, devices, connections, requests, and configuration changes continuously to ensure that no one is accessing something they shouldn’t.

    3. Verify Explicitly

    Verify that users are accessing things securely. Have security mechanisms in place to ensure they’re doing that. This includes enforcing policies dynamically via the policy engine and policy administrator (PE determines whether access is approved or denied and the PA executes that decision). And, as always, monitor and log all access requests and traffic.

    An overview illustration of the zero trust security approach
    Image caption: This graphic represents a basic overview of the foundational concepts behind zero trust: trust nothing and no one, have security mechanisms in place for identity and device verification, and assume all traffic (both inside and outside the network) is an attack.

    There’s No One-Size-Fits-All Approach to Zero Trust

    There are different approaches to zero trust put out by different organizations and different standards as well. Probably the most commonly known zero trust framework is the National Institute of Standards and Technology’s (NIST) special publication: NIST SP 800-207 — Zero Trust Architecture. This document laid the groundwork for other frameworks from agencies such as the U.S. Department of Defense and the National Security Agency (NSA).

    These other frameworks have a lot to offer information of information and applications. (The DoD guidelines, in particular, offer more breadth and depth than the NSA’s.) And we’ll touch on key concepts from these resources throughout the article.

    Why Zero Trust Matters: Looking Beyond the Surface to Secure Your Digital Assets

    We live in a time when you can no longer take things at face value. You can’t simply assume that someone is who they claim to be simply because they type in a username and password; all it takes is a small third-party data breach for someone’s password to become known to the dark web. And if that person uses that same password to secure multiple accounts, then attackers can use it to brute force their way into their accounts.

    This is why it’s crucial that we look much deeper and look at other verifiable and contextual information. This approach helps us determine whether someone requesting access to sensitive resources is authentic and has the authorization to access those assets.

    Discussing this topic of zero trust always makes me think of scenes from the Mission: Impossible movie franchise. In several movies, Tom Cruise’s character, Ethan Hunt, wears masks and contact lenses to impersonate key characters. Sure, on the surface, he looks like each of the people he’s pretending to be. He can even use a voice modulator of some kind to sound like each person he’s impersonating. But just because he looks and sounds like that person doesn’t mean Ethan Hunt (Cruise) really is them.

    Now, let’s leave Hollywood behind for a second and imagine if someone who looks and sounds like your boss or CEO walks into your building. You’d likely assume that it’s him or her. That would be pretty hard to fake, right? Heck, if I saw someone walk in who looked and spoke like our CEO, Bill Grueninger, I’d likely assume it’s really him, too. But if I walked up and started tugging on his face to see if it’s a latex mask or is the real deal, I’d likely find myself landing a really uncomfortable meeting with HR.

    In a digital environment where users authenticate remotely, though, you need to have a way to verify their identities are legitimate. It makes you wonder what major cyber security incidents and data breaches may well have been avoided if the targeted organizations adopted zero trust policies and processes…

    A zero-trust environment differs from a traditional security approach in that zero trust means you have continuously prove your trustworthiness, whereas a traditional environment means that once you’re inside the network, you’re automatically assumed to be safe.

    A graphic with two parts: the first illustrates the concept of a traditional network with an implicit trust zone. The second shows a zero trust network with a no trust zone.
    Image caption: A set of illustrations that show the difference between a traditional trust-based network and a zero trust network.

    Unfortunately, the traditional model no longer works in a world of credential phishing and session hijacking. You need more robust security and authentication measures in place.

    If you search online, you’ll notice that different organizations approach zero trust in different ways. For the sake of this article, we’ll talk about the seven pillars of zero trust in terms of how the U.S. Department of Defense framework defines them. The seven zero trust pillars we outline below are overarching categories of focus for implementing zero trust. Each pillar involves monitoring and logging but also entails other specific protections.

    A graphic using a columned building to illustrate zero trust architecture with each column representing a different pillar of zero trust
    Image source: A diagram we created based on the U.S. Department of Defense’s seven zero trust pillars with the addition of CA and PKI-based digital identity.
    1. Users — Controlling access to protected resources by continuously authenticating users using digital identity components (such as client authentication certificates) and verifying users’ access authorizations.
    2. Devices — Use device digital identity (think TPMs, device certificates, etc.) to authenticate access in real time. Devices also must be patched to mitigate vulnerabilities.
    3. Network/Environment — Segmentation, isolation, and policy restrictions are three critical components to control access and manage how data moves on your network. This approach helps to restrict access and prevent lateral movement within the network.
    4. Applications and Workloads — Whether you’re using resources that are on-prem, cloud, or a hybrid approach, the idea here is to secure the application layer.
    5. Data —Secure your data by developing a comprehensive data management strategy and integrating data security measures such as at-rest and in-transit data encryption. This will help protect your data both while it’s on your servers or moving between two endpoints.
    6. Visibility and Analytics — Having full visibility of your IT environment is crucial to keeping it secure. You can’t protect assets you don’t know exist, and you can’t stop attackers when you don’t realize something is wrong. You can gain actionable insights to improve your cyber security by analyzing your network’s traffic and user behaviors in real time to identify threats. Just be sure to consider that some traffic may contain sensitive data, so decide the best approach (such as informing users and obtaining their consent ahead of time).
    7. Automation and Orchestration — Automation is a scalable approach that takes monotonous tasks off your team’s plates, freeing them up to focus on tasks that require critical thought processes. These tools also enable you to quickly sort through all the noise your security tools generate to find valuable data.

    Zero trust as a cyber security approach has gained strong support over the last several years. This is partly because of the use of identity-based authentication and user authorization that’s required. In a nutshell, here’s a quick overview of how access controls and management play together to boost your organization’s cyber security:

    • Access controls are the rules, settings, and tools you use to control access to sensitive data and resources.
    • Access management is the process of setting up and managing who has authorization to access specific resources and systems.

    Of course, neither of these things is foolproof and requires another security layer in the form of authentication. User and device authentication are all about ensuring that only entities (i.e., those whose digital identities have been verified and their authorizations confirmed) can access your secure digital assets.

    Continuous Authentication Is Integral to Zero Trust

    A key element of the zero trust approach is a concept known as continuous authentication. The idea behind continuous authentication is that all network users, including your employees, must not only prove their identities when they first log in but also continuously prove their identities throughout their sessions.

    Why is this necessary? Because session IDs can be set to last for extended periods — anywhere from a few hours to even a few weeks. This means that if a cybercriminal steals an authenticated user’s access tokens (session IDs and cookies), they can pretend to be them and access whatever protected resources their account has the authorization to access.

    While some platforms have mechanisms to prevent authentication from happening, this may not always be the case. And it’s true that you can set timeout limits to take effect after certain periods, but if you don’t bother setting up these security limits, then it’s inevitable that at least one bad guy might slip through the cracks.

    Continuous Authentication Requires Verifiable Digital Identity

    For zero trust security to work, you need to have a way to prove that you’re really you and aren’t an imposter who’s trying to fraudulently access sensitive data, systems, and other resources. The way to achieve this level of reliable and verifiable digital identity is through the use of public key infrastructure (PKI) and digital certificates. (We’ve talked a lot about these concepts before, but we’ll talk more about them again a little later in the article.)

    Digital certificates are small data files that pack massive punches. They contain verified identifying information about you and/or your organization that a trusted authority (certificate authority) attests is authentic.

    You can think of digital certificates in much the same way as an official passport: that little government-issued booklet contains verified information about you that proves your identity to people you’ve never met. This way, you can show your passport to airport security and other authorities (i.e., people who don’t know you) to prove you’re really you. (Sorry, there were a lot of “yous” in that paragraph.)

    What do digital certificates and continuous authentication have to do with one another? Everything, really.

    • In a zero-trust environment, there are no implicitly or explicitly trusted users, devices, or zones within your network or IT environment. The digital identities of everything and everyone must be authenticated continuously using verifiable methods — period. And digital certificates are a means of doing precisely that.
    • Digital certificates enable trusted third parties to attest to your digital identity’s authenticity. It’s kind of the digital equivalent of how the U.S. Department of State attests to an American’s identity each time it issues a passport.

    Public Key Infrastructure and Zero Trust = The Perfect Combination

    In a zero-trust environment, each employee, device, or other network user must have a way to mutually authenticate in a way that’s verifiable. How? By using a security mechanism that the security of the internet itself is built upon: public key infrastructure (PKI).

    Public key infrastructure is the combination of rules, processes and technologies that enable two parties to communicate securely. Without PKI, if you were trying to connect to your bank’s website, it would be risky: you wouldn’t have a way to securely send your data because you wouldn’t know for sure who was on the other end of the connection. Even if the connection is encrypted, if you’re connecting to a cybercriminal, they’d have the decryption key to unscramble your data and read it.

    Remember the DoD Zero Trust initiative that we mentioned earlier? Its DoD Zero Trust Architecture document shares one of the most beautiful lines we could hope to read in a government resource as an explanation: “The use of mutual authentication of users with PKI-based client authentication or mutual authentication certificates to web applications has long been the effective standard.”

    Darned right, it is. And that’s because PKI isn’t the new kid on the block; it’s been around the block many times since its inception in the mid-1980s. PKI has served as the trusted foundation of internet security since that time because it’s what enables secure remote communications and data transmissions that, otherwise, would be impossible.

    When it comes to remote user authentication and access, looking beneath the surface is a necessity. You can’t simply see that someone logs in using a basic username-password combination and assume it’s the legitimate account owner; you need an additional layer of verification that continually proves it’s the authentic user. Adopting a zero-trust approach can help in several ways:

    Prevents Compromised Credentials and Access Tokens From Being Exploited

    Implementing zero trust is a way to prevent cybercriminals from taking advantage of vulnerable access tokens (session cookies, IDs, or weak credentials) to gain access to sensitive resources while pretending to be legitimate network users. Yup, that’s right — if even one of your employees who has privileged access uses a weak password for their account, it could be game over for your business. All it takes is one bad enough “oops” to cause you to face immense penalties, lawsuits, or even have to close your doors forever.

    Protects Your Brand and Nurtures Customers’ Trust

    Incorporating zero trust into your cybersecurity strategy is also a great way to help protect your organization’s reputation, brand, and bottom line. Okta’s 2021 State of Digital Trust report shows that 75% of American consumers say they likely won’t do business with brands they don’t trust (i.e., after a data breach or misuse of data). Almost half, a whopping 47%, say they’d take things a step further and would permanently stop using a company’s services for the same reasons.

    Imagine what would happen if an unauthorized user gained access to your most sensitive data. This could be your intellectual property (IP), customers’ financial data, or even employees’ records. Regardless of which type of data they get their slimy paws on, exposing sensitive data would spell disaster for your organization.

    Helps Mitigate Other Issues

    In addition to the no-brainer reason of you don’t want your information accessed by unauthorized individuals, there are also other concerns that adopting zero trust could help you avoid

    • Non-compliance issues with regard to industry standards,
    • Data breaches that can lead to hefty fines, penalties, and lawsuits,
    • Your reputation taking a big hit, and
    • Customers not trusting you or your services.

    We’ve seen this type of scenario happen time and again in various data breaches. Here’s a quick example of what could happen without a continuous authentication mechanism in place:

    1. An attacker phishes one of your company’s key employees, tricking or manipulating them into coughing up their privileged access credentials or session ID. This may not be hard considering that IBM’s X-Force Threat Intelligence reports phishing as the attack vector in two in five incidents their team responded to.
    2. The attacker uses their login info or session ID to access secure resources using that employee’s account. Once in, they’re able to move laterally across the company’s network — accessing applications, databases, and other resources that the employee’s compromised account has access to — pillaging as they go.
    3. Once they find interesting and valuable data, the attacker exfiltrates whatever data they can to an external server they control before installing malware onto your systems. It’s a devastating one-two punch you never saw coming that can bring your company to its knees.
    This illustration provides an example of what can happen without adopting a zero trust approach. An employee's session ID or login credentials could be stolen and used by an attacker to fraudulently access the employee's session to steal your organization's data or install malware
    Image caption: A diagram that illustrates the basic concept of how an attacker can exploit compromised credentials in a non-zero trust environment.

    Because your organization didn’t require continuous authentication (i.e., didn’t implement zero trust) or have restricted policies in place that are enforced, your IT security admin or cyber security team doesn’t realize that anything is amiss until it’s too late. Now, you’re not only dealing with a data breach, you’re also scrambling to deal with the ransomware situation as well.

    But wouldn’t a firewall be able to tip off your cyber defenders that something’s wrong? Sure, event logs will show a significant increase in traffic. But since the traffic appears to be legitimate (because the attacker is using the employee’s legitimate credentials, may be using a proxy IP address to disguise their true location, and you’re not analyzing device identity attributes or behaviors), they may not initially realize that it’s actually an external attacker and not your legitimate employee accessing your systems until the damage has already been done.

    Oh boy. We hope you have business continuity, disaster response and disaster recovery plans in place, and that those plans are not only current but that your employees know what their roles and responsibilities are! Cyber resilience is crucial; but without the right security mechanisms, strategies and plans in place, you may not like the outcome.

    Insider Threats in Action: A Real-World Look at the Elliott Greenleaf Breach (2021)

    Attackers are becoming increasingly sophisticated and potential attack surfaces are expanding. As such, our defense of these systems must become more robust and dynamic. To go beyond discussing zero trust from a largely conceptual standpoint, let’s dive deeper and explore the damage caused to a real-world organization by bad actors within its trusted internal network.

    What Happened

    In January 2021, the Pennsylvania law firm Elliott Greenleaf was the victim of an insider attack and sustained catastrophic financial losses, according to WestLaw.com. According to multiple reports, four attorneys and a paralegal secretly downloaded a slew of invaluable sensitive data, including confidential files, trade secrets, and client lists. Their actions as insider threats resulted in irreparable damages to their former employer, which has since filed a lawsuit against the four attorneys and the paralegal.

    The National Institute of Standards and Technology (NIST) defines insider threats as:

    “The threat that an insider will use her/his authorized access, wittingly or unwittingly, to do harm to the security of organizational operations and assets, individuals, other organizations, and the Nation. This threat can include damage through espionage, terrorism, unauthorized disclosure of national security information, or through the loss or degradation of organizational resources or capabilities.”

    As it turns out, these legal professionals, who were trusted to operate internal systems (seemingly with little to no oversight), were wolves in sheep’s clothing. They were joining a rival law firm in Delaware (Armstrong Teasdale) and, it appears, wanted to take Elliott Greenleaf’s info with them.

    Unfortunately, this isn’t an uncommon scenario; Code42’s research shows that there’s a one in three chance an organization will lose intellectual property when one of its employees quits.

    How It Happened

    Let’s quickly break down what occurred that enabled these insiders to wreak havoc based on information shared by Digital Guardian and WestLaw:

    • The attorneys had immense access to files and data. The attackers had access to read, steal, and destroy highly sensitive information. For example, they reportedly shredded 288 lbs of physical documents. (That’s approximately 28,800 pieces of paper if you’re using standard copy paper). In some cases, they enlisted the help of the paralegal to get certain data for them.
    • They accessed systems that appear to lack monitoring and/or alerts. To steal data, they were able to use one or more personal USB devices and had cloud-based file-sharing apps installed on their company devices.
    • They were able to send and delete emails containing sensitive information without detection. As such, they could send additional sensitive information to personal email accounts — and subsequently “double-delete” the messages in an attempt to cover their trails. Granted, the company says it’s able to access the delete emails via their data backup systems, but by that time, the damage had already been done.

    The Big Takeaway From the Elliott Greenleaf Law Firm Situation

    Unfortunately, the Elliott Greenleaf law firmed learned a valuable lesson the hard way: This catastrophe likely could have been prevented (or identifier earlier) if Elliott Greenleaf had adopted a zero trust approach. With zero trust:

    • the employees’ access should have been continuously verified across all systems,
    • their reach (i.e., their permissions and breadth of access) should have been restricted to only what they needed to do their jobs (think policy of least privilege), and
    • their access to resources and use of USB devices should have been disabled — or, at the very least, monitored, logged, and analyzed.

    It’s our hope that you that you keep this story in mind and recognize that the threat from within your organization can be as, if not more, dangerous than outside attackers. Although the damage caused by this insider breach is irreversible, future attacks of this nature can be prevented through by adopting a zero trust posture.

    Now, we’re not going to get into the nitty-gritty of how to actually implement zero trust. There’s far too much information that would need to be covered that it would, basically, entail creating a whole other article. However, NIST (SP 800-207) and the DoD (DoD Zero Trust Reference Architecture) provide some guidance for federal agencies on how to build zero trust architectures (from the ground up or migrate their systems to zero trust over time). Some of this information may be useful to your organization as well.

    Adopting a Zero Trust Strategy Is One of the Best Ways to Secure Your Organization

    Zero trust isn’t totally new, and it certainly isn’t going anywhere anytime soon. It’s gaining traction over time. Okta reports that 55% of surveyed organizations globally indicate that they have a zero trust initiative in place. A whopping 85% of global 2000 (G2000) companies said they’d allocated “moderate” or “significant” year-over-year increases in budgets to fund these initiatives.

    Of course, there is still room for improvement. Research from Forrester and Illumio shows that only 6% of organizations indicate that they have fully deployed zero trust within their IT environments. But, hey, it’s a start, right?

    One of the key attributes of zero trust is limiting who has access to what. This involves setting and enforcing policies, using verifiable digital identity, following the least privilege principle, monitoring all access attempts and behaviors, etc. By limiting a user’s reach to only the resources and systems they need to do their jobs, you reduce your attack surface. So, rather than having cybercriminals have access to everything, they can only access the systems and data that the user is authorized to access.

    In a zero-trust environment, a bad guy will first have to go through a series of verification checks to ensure they’re the authentic user. If they fail that, then they won’t get access to anything. If they succeed, then at least their reach will be restricted to the privileges you’ve assigned the compromised user’s profile. And since you’re keeping an eye on everything and are logging everything for analysis, it’ll help you better mitigate these issues in the future.

     

    Article published on TheSSLStore by Casey Crane

  • What Is Encryption? A 5-Minute Overview of Everything Encryption

     

    Encryption is everywhere online; it’s the process and technologies that enable you to securely log into your email and make online purchases

    What types of information are you sending in emails or via website connections? What are you storing on your company servers? Inquiring minds want to know — namely, cybercriminals.

    Data from Orca Security shows that more than one-third (36%) of organizations don’t bother encrypting the sensitive data they store in the cloud. This includes data such as intellectual property to customers or employees’ personally identifiable information (PII).

    We’ve seen multiple instances of security issues this year involving unencrypted data:

    One way to fight back against cybercriminals is to use encryption to secure your data. But what is encryption? I mean, what does encryption mean, both in the sense of what it does and how it secures your data and communications?

    Let’s hash it out.

    What Does Encryption Mean? A Quick Data Encryption Definition & Meaning

    Encryption is the process of taking plaintext data and transforming it into something random and unreadable. Why? It’s a way to secretly share information by restricting access to it. This way, only your intended recipient (i.e., whoever you want to read the message) can access it and no one else can.

    Encryption involves using two specific types of cryptographic tools:

    • Encryption algorithms (which need to meet specific cryptographic security standards)
    • Encryption key (which needs to be securely generated)
    Image caption: A basic illustration showcasing the process of data encryption.

    Looks simple enough, right? Appearances can be deceiving. The way cryptographic processes work in the background is a lot more complicated than how it appears on the surface. When you encrypt a message on the internet, you’re using a special string of randomized data called a cryptographic key. Keys can either be a set of two unique keys (asymmetric keys), or a single key (symmetric key) that encrypts and decrypts data. We’ll speak more on asymmetric and symmetric key encryption a little later.

    When applied, the key disguises your message by turning it into gibberish. This ensures that only the person who holds a corresponding secret key (i.e., your intended recipient) can read the message through a process known as decryption.

    The following illustration shows a basic overview of what the process looks like when sending a secure, encrypted message:

    A basic illustration of what it looks like when a cybercriminal tries to intercept data in an encrypted communication channel.
    Image caption: A basic illustration of how encryption protects sensitive data from unintended eyes.

    So, how do you know if a website is using a secure connection? It’s got a little padlock icon or another security indicator displaying in the browser’s URL bar:

    1671092879 367 What Is Encryption A 5 Minute Overview of Everything Encryption

    We’ll delve more into that in just another minute or two. But first, there’s one important thing we want to touch on before moving on to talking about what encryption does…

    Secure ≠ Safe

    When people see the padlock icon in their browser, they typically assume it means the website they’re using is safe. That’s not necessarily true. You can still have a website that uses a secure connection but it’s not safe because the site is controlled by one or more cybercriminals. This is why we always tell people that a secure website isn’t necessarily a safe website.

    The way to help customers ensure that they’re connecting to your legitimate website is to add digital identity to the equation. Your digital identity is like your passport; it’s a verifiable way for people who don’t know you to feel confident doing business with you. This is because you have a trusted third party (a certificate authority) vouching that you’re authentic — that you really are (insert your company’s name here).

    You can add digital identity by installing a website security certificate, or what’s otherwise known as an SSL/TLS certificate, on your server. This will enable data to transmit using the secure HTTPS (hypertext transport protocol secure) protocol instead of the insecure HTTP.

    Here’s a quick example of what an extended validation (EV) SSL/TLS certificate looks like in Google Chrome:

    A combined set of screenshots of Wells Fargo's SSL/TLS certificate we captured from wellsfargo.com. The SSL/TLS certificate shows the validation organizational information of Wells Fargo in its details.
    Image caption: A combination screenshot of the SSL/TLS certificate for wellsfargo.com. As you can see, the certificate displays the company’s (subject) verified organizational information, including its location.

    SSL/TLS certificates come in three validation levels: domain validation (DV), organization validation (OV), and extended validation. They rank from lowest to highest in terms of the digital identity assurance they offer (hence why EV certificates are sometimes called high assurance certificates).

    Why You Need to Secure Your Data

    There are several reasons why your organization needs to secure your data and communication channels:

    • You’re required to do so for compliance. Depending on your industry or geographic region, it’s likely that there’s at least one data security regulation or law in place that requires you to secure your data using encryption.
    • You want to protect your reputation. The importance of your brand and reputation can’t be overstated. Not encrypting your data is a surefire way to get yourself some unwanted publicity. If you don’t secure your data, it’s likely just a matter of time before it falls into cybercriminals’ hands.
    • Customer trust matters to you. Encrypting your data goes a long way in helping you develop relationships with customers. If they know that you do all you can to keep their data safe, they’ll be more likely to want to do business with you. If you don’t and let it be known that you’ve had a cybersecurity incident, nearly one-third say they won’t do business with you.
    • Fines, penalties, and lawsuits don’t appeal to you. Don’t spend money on fines, penalties, and lawyers if you don’t have to. You can avoid many situations where you’d face these things by securing your sensitive data.  
    • It’s the right thing to do. There’s something to be said for just doing the right thing because it’s the right thing to do. Protecting the data that people and other organizations have entrusted you to protect definitely fits into that category.

    Encryption Secures Your Sensitive Transmitting and/or Resting Data

    Encryption can be used to encrypt everything from data sitting in your databases to the data that streams from the IoT devices on your network. Without encryption, every day would be open season on your most sensitive data. This is why organizations should use encryption to protect sensitive data at all times.

    Protecting Data in Transit from Man-in-the-Middle Attackers

    Data in transit encryption can be used to secure your data while it’s moving between endpoints. A great example of in-transit data encryption can be seen when your customers’ browsers send information to your web server. This is known as in-transit data encryption, which protects you from interception attacks (i.e., man-in-the-middle attacks).

    Good examples of this are secure SSL/TLS website connections. If you don’t secure your website using an SSL/TLS certificate, cybercriminals could simply wait for your customers to log in to your website and steal their credentials. They do this by intercepting the data, placing themselves in the middle of your connection so all data flows between the customer and the server through them.

    Not only does this spell bad news for your customers, but it’ll be bad news for you since they’ll no longer trust you to protect their data.

    Keeping Your At-Rest Data Safe On Your Servers

    If your data is sitting on your server, that automatically means it’s safe from attackers, right? Not necessarily. Data at rest encryption plays an important role in keeping the data sitting in your databases, inboxes, and other important repositories secure. For example, if someone hacks your email server, any unencrypted messages are at risk of compromise.

    Encrypted Data Is Meant to Be Decrypted…

    Yes, you read that correctly: Encryption is known as a two-way function because encrypted data is meant to be decrypted by someone who has the appropriate key. When you encrypt something, you need to use a key to decrypt that data. In asymmetric encryption, you have two separate keys and each key performs a separate function (one encrypts, one decrypts). In symmetric encryption, it’s a single key that performs both functions.

    It’s important to note that encryption algorithms differ from hash ciphers. While encryption ciphers are meant to be reversed, hash algorithms are designed to serve as one-way functions. Their resulting strings of data are not intended to be reverse-engineered [and, frankly, it’s too impractical to try to do so]). And instead of being used to encrypt data, they’re used as data integrity mechanisms to prove that data hasn’t been altered since it was digitally signed.

    Encryption is a way for two parties to communicate securely. Historically, this meant two parties would have to meet face to face to securely exchange keys. They’d use the same key to encrypt and decrypt information. This is an example of a type of encryption known as symmetric encryption. Also known as private key cryptography, this approach entails using a single key to scramble and unscramble your messages.

    Here’s a basic look at how encryption and decryption work using symmetric (matching) keys:

    What is encryption graphic: A basic example of encryption and decryption
    Image caption: A screenshot of a symmetric encryption algorithm that shows how both parties have a copy of the same key they can use to encrypt and decrypt messages.

    Of course, the encryption ciphers we use to communicate over the internet are far more complex than the simple example we’ve provided above. However, the graphic gives you the basic idea of the concepts of encryption and decryption.

    Symmetric Encryption Has Been the Go-To Method Throughout History

    Symmetric encryption is nothing new; it’s been around for thousands of years, dating back to at least ancient Egypt. It’s the old, trusted war horse of cryptography and it’s had many reinventions over its lifetime.

    When I was a kid, I had out-of-state cousins who would come to visit my family. My cousins and I would exchange handwritten letters, and one of my cousins used to write brief messages in ciphertext. It was a basic shift cipher (AKA a Caesar cipher), meaning that you just shift a letter by one or more characters in the alphabet. The number of movements is determined by a secret key that only we would know. (This way, her siblings and mine couldn’t read our messages.)

    For example, if we used a key of 6, then “a” would become “g” and so on. So, if the cousin wrote the word “beach” and used a key of 6, then it would become “hkgin.” Because we both had knowledge of the key, this is a basic example of how it looks when you use symmetric encryption.

    Traditional (Symmetric) Encryption Can’t Stand on Its Own in an Internet World

    We live in a time when the internet has become integral to businesses. This invention is a double-edged sword; it’s great because companies can engage in remote, near-instantaneous communications. But that also means that no one wants to hop on a plane and fly halfway around the world every time they need to do a transaction.

    But why would you need to do this? Because the internet is inherently insecure. It’s an open public network that sends plaintext data, meaning that your sensitive information can be intercepted by bad guys who can use it to carry out all kinds of evil (data theft, identity theft, fraudulent transactions — the list goes on). This is why industry experts had to come up with a way for people to communicate securely without having to first meet up to exchange symmetric encryption keys.

    Why Asymmetric Encryption Is Essential to Secure Online Communications

    In a nutshell, asymmetric encryption (i.e., public key encryption) enables people to communicate remotely without having to meet up in person. This type of encryption uses a pair of unique (but mathematically related) keys to carry out the encryption and decryption processes.

    People call it by different names, but this type of encryption boils down to the following breakdown:

    • The sending party encrypts the message using their public key.
    • The receiving party decrypts the message using the corresponding (separate) secret key.

    What this does is enable you to communicate data in open channels (public and insecure networks), such as on the Internet. Here’s a look at how this process works from a little more technical perspective:

    An illustration of how the encryption and decryption process works in asymmetric encryption
    Image caption: A screenshot of how it looks when you transmit encrypted data to a website using asymmetric encryption.

    Think of the last time you made an online purchase. When establishing the website connection, your browser reached out to the website’s server. The two parties exchanged some key information (literally and figuratively speaking) that they used to exchange a session key. This key is what they then used the rest of the session to communicate because it required fewer resources than an asymmetric connection.

    Asymmetric vs Symmetric Encryption: Is One Better Than the Other?

    It’s not so much a question of which one is better; asymmetric and symmetric encryption both play important roles in securing online data and communications. Quite frankly, you need both to achieve secure website connections:

    • You use asymmetric encryption to securely exchange key-related information
    • You use that shared key information to create a secure symmetric session that can be used to communicate the rest of the session

    You use asymmetric first because it’s a secure way to share your symmetric keys on the (insecure) internet. But asymmetric algorithms require a lot of resources, meaning they’re not great at scale (i.e., enterprises handling massive traffic). So, the smarter idea would be to use asymmetric algorithms at the beginning and then switch to symmetric algorithms that are less taxing at scale.

    The More Important Considerations Are Key Security and Certificate Management

    The encryption algorithms you use are only as good as the security you use to protect your cryptographic keys. If even one of your cryptographic keys gets exposed, then you’re in for a world of hurt because it means that every bit of data that key encrypted is now at risk of compromise. For example, this could be the case if you didn’t use algorithms that enabled perfect forward secrecy.

    Furthermore, you also need to carefully track and manage all of the certificates in your environment. If even one certificate expires and is still used on your website, for example, then it means:

    • Users see ugly “not secure” warning messages on your website
    • All data that transmits to your website is insecure

    Final Thoughts on What Encryption Means

    As you can see, answering the question “what is encryption?” in the simplest terms isn’t always easy, but we gave it our best shot. (It’s easy to overthink things.) Hopefully, you’ve found this article both informative and useful as you go about your day. The big takeaways we want you to leave with include the following:

    • Encryption is a common cryptographic process for disguising or concealing data
    • Encryption secures your data both in transit (think SSL/TLS) and at rest (think of emails on your server)
    • It can be done using unique keys (symmetric encryption) or identical key pairs (symmetric encryption)
    • For encryption to work, you must carefully manage your certificates and keys

     

    Article published on TheSSLStore by Casey Crane

  • Digital Signature vs Digital Certificate: A Quick Guide

    Digital certificates are akin to the internet’s versions of certificates of authenticity. Here’s what you need to know about them and the public key cryptographic technologies that make them work

    Digital certificates and/or signatures make your world more secure virtually everywhere you look online. These tools allow you to send secure emails and exchange sensitive information remotely without having to worry constantly that your data might fall into the wrong hands.

    But what is a digital signature? What is a digital certificate? How do they integrate seamlessly into your everyday life as both a consumer and service provider (even if you don’t know it)? We’ll answer all of these questions in this article that breaks down the difference between a digital signature vs digital certificate.

    Let’s decode it..

    Digital Certificate vs Digital Signature: A Look at the Differences Between the Two

    Digital certificates and digital signatures are just two halves of the same coin. When you’re talking about a digital signature vs digital certificate, each plays a role in establishing and validating digital identity and aids in helping your organization facilitate digital trust. Digital trust is critical to elevating your brand and helping customers feel confident and secure doing business with you.

    We’ll go more in-depth on each of these concepts throughout the article. But first, we know some of you are in a hurry and don’t have much time to read this article. We’ve put together a brief overview so you’ll quickly get the gist of the differences and can move on your way:

    Digital Certificate Digital Signature
    What It Is A small data file (X.509 format) that contains identifying information (usually about a person and/or an organization) It’s a signed digital asset that consists of a string of characters created by hashing data and encrypting the resulting value. You use a digital certificate to create a digital signature.
    How to Describe It to Your Non-Technical Colleagues It’s like a passport for the digital world: it’s issued by a trusted third party and offers assurance that you’re you It’s like a notarized signature; it’s often used to show that digital assets (such as documents, messages, files, etc.) you create are authentic and haven’t been altered somehow
    What It Does A digital certificate ties your organization’s verified identity to a digital asset (website, email, software, etc.) A digital signature shows who created a file, message, or other digital asset, and that it hasn’t been changed since it was signed
    How It’s Created Create a certificate signing request (CSR) and send the information to the certificate authority. They’ll verify your identity and issue the certificate In most cases, you’ll need a digital certificate in order to create a digital signature. Once you have a certificate, many platforms (Windows Server, OpenSSL, Microsoft Word, Adobe, etc.) make it easy to create and apply a digital signature through the use of a hash function and encryption
    Where You Can Find One Installed on web servers, web applications, email clients, computers, mobile devices, IoT devices, etc. Many important files (such as software installers, PDFs, secure emails, etc.) contain digital signatures.
    How Long It Is Valid Each digital certificate is created with a set validity period — i.e., it has both issuance and expiration dates Digital signatures can be valid far longer than the certificate that created it when it is timestamped

    Alright, now that we’ve had this overview that highlights a digital signature vs digital certificate, let’s dive a little more in depth into each of these elements…

    What Is a Digital Certificate?

    A digital certificate is a digital file containing verifiable information about you or your organization that validates your authenticity. Basically, it’s a way for the other party you’re connecting to, to check whether you are who you say you are (i.e., you’re not a fraudster).

    Digital certificates are kind of like the organizations that issue certificates of authentication for athletes’ autographs. If I want to ensure that I’m getting hockey goaltender Andrei Vasilevskiy’s signature (Go Bolts!), I’m not just going to buy it from some random person on eBay. I’m going to get it from a reputable source that provides a genuine certificate of authentication.

    Likewise, the same concept applies to installing code, software, and other executables from reputable sources. You won’t just download unsigned software from a third-party website that could be counterfeit and contain malware, right? (Please say you won’t.) It’s too risky and leaves you vulnerable to data compromise, identity theft, and a slew of other security issues.

    Digital certificates are X.509 files that you’ll find at the heart of public key infrastructure (PKI). They come in multiple varieties that serve various purposes:

    • Code signing certificates help you prove the authenticity of your software, containers, and code and protect it against unauthorized modifications.
    Image caption: A screenshot of the code signing certificate information that displays in Chrome for one of our company’s digital certificates.
    • Document signing certificates help you prove the authenticity and integrity of your Microsoft Office and PDF files. (NOTE: Not all document signing certificates can be used to digitally sign Adobe PDFs.)
    • Email signing certificates help you prove to recipients’ email clients and servers that your emails are legitimate and haven’t been altered. They also enable you to send secure, encrypted messages to recipients who also use email signing certificates.
    Digital signature vs digital certificate graphic: A set of screenshots that show the verified digital identity of the person the certificate was issued to.
    Image caption: A screenshot of the email signing certificate information that displays in Chrome for one of my digital certificates.
    • Client authentication certificates (AKA personal authentication certificates) help you remotely verify your identity so you can access web apps and other resources online. These are frequently the same certificates as email signing certificates
    • SSL/TLS certificates help you prove that your website is authentic (owned by you) and enables your server to establish secure connections with users to protect their data in transit.
    A set of screenshots that showcase TheSSLstore.com's digital certificate information, including info about Rapid Web Services, LLC (the organization that the certificate was issued to on behalf of TheSSLstore.com).
    Image caption: A screenshot of the SSL/TLS certificate information that displays in Chrome for TheSSLstore.com.

    What Is a Digital Signature?

    A digital signature is something you apply to a specific file (using your digital certificate) to prove that the file was created by you and is authentic. In the most basic sense, a digital signature is a way to prove you’re really you (authentication) and that something you created is legitimate (data integrity). More technically speaking, it’s data that proves your identity and that the digital asset you’ve created and signed hasn’t been secretly modified.

    In a more technical sense, digital signatures are the values that result from applying a hash function to the data of the digital asset (software, email, document, etc.) you wish to protect and authenticate. This creates a string of data known as a hash value, which you then encrypt using a cryptographic key.

    There’s sometimes a bit of confusion surrounding digital signatures and electronic signatures. You’ll find people and companies within the industry referring to them interchangeably. However, that’s not quite accurate. A digital signature is a type of electronic signature, but not all electronic signatures are digital signatures. It’s kind of like how all fudges are desserts, but not all desserts are fudge.

    An electronic signature is the digital equivalent of your handwritten signature, whereas a digital signature is something else that doesn’t always have a visual element representing it. Electronic signatures can often be mimicked or faked, but digital signatures cannot be easily copied or faked.

    Digital signature vs digital certificate graphic: A compilation image that visually illustrates the difference between a digital certificate vs digital signature
    Image caption: A screenshot that shows the difference between an electronic signature (left) and a digital signature’s visual mark as represented by Outlook and Adobe PDF.

    To learn more about what a digital signature is and when to use a digital signature certificate, be sure to check out our other articles on those related topics.

    Timestamping Extends the Life of Your Digital Signature

    If you want to get the most out of your digital signature, use a timestamp. Timestamping is a method of proving that whatever you signed was signed at a specific moment. It’s an indelible record that shows when your digital asset was signed or modified. By adding a timestamp to something you digitally sign, you’re also extending your signature’s longevity.

    A set of screenshots that are layered partially on top of one another and display information relating to JetBrains software's digital signature and certificate information
    Image caption: A screenshot of the digital signature and timestamping information for a version of JetBrains software that was downloaded.

    Of course, you don’t always have to timestamp your digital signature; it’s considered an optional feature in some use cases. But timestamping is something you should definitely consider doing when signing software and documents. Why?

    • Timestamping your digital signature enables it to be trusted years beyond when your digital certificate expires.
    • Adding a timestamp provides a verifiable way to show the precise moment when something was digitally signed.
    • Adding a timestamp to your code also mitigates the error messages that would otherwise appear when your digital signature certificate expires. It also means you don’t have to re-sign and release a new version of your asset (unless you changed the file somehow).
    • Trying to fake your digital signature’s timestamp would be challenging for cybercriminals to achieve.

    There’s a bit of a misnomer that timestamping means that your digital signature is valid forever and will never expire. This isn’t the case. Your signature will eventually expire; it just won’t expire as quickly as your digital signature certificate does.

    Digital Signatures and Certificates Are at the Heart of Digital Trust

    Nowadays, you always hear people throwing around the term digital transformation, which is all about integrating digital technologies to fundamentally enhance your organization (e.g., increase connectivity and operational efficiencies). But there’s another concept that isn’t just a buzzword and deserves more attention than it receives: digital trust.

    Digital trust is everything relating to establishing and upholding trust — it’s the behind-the-scenes processes, compliance, and security mechanisms that make trusting your brand possible for customers. At its core, digital trust boils down to three key elements:

    1. Digital identity — Offering assurance regarding your verifiable digital identity so they know you’re real and aren’t a shyster,
    2. Data integrity — Providing assurance and the means for customers to verify that they can trust your asset’s legitimacy, and
    3. Encryption — Securing communications and data and communications so they can feel confident doing business with you.

    Now, I’m going to say something a bit controversial here: you don’t deserve your customers’ trust. While this may sound very negative, the truth is that trust isn’t something customers should give blindly; those days are long gone. In the Age of the Data Breach, trust is something you should — and must — strive to earn.

    You can have the fanciest office and IT technologies at your fingertips. But without achieving and securely managing digital trust, your digital transformation is half-baked and won’t live up to your (or your customers’) expectations.

    Keeping Your Certificates Secure Requires Careful Management

    Your digital certificates and the signatures they create won’t do your business any good if you don’t bother to keep them — or, more importantly, their keys — secure. You see, every digital certificate is issued with a key pair. In the case of publicly trusted certificates (such as the ones we’ve mentioned that are used for external uses), that keypair includes a public and private key. Public keys are available to virtually anyone, but private keys are secrets that must be protected.

    As of 2020, Keyfactor reported that the average business’s IT environment has an average of 88,750 digital certificates and keys to authenticate systems and secure data. In 2022, Keyfactor also reported that the average number of “internally issued certificates in an IT organization alone” has surpassed 267,000.

    If a bad guy manages to get their grubby paws on even one of your organization’s private keys, then you’re in for a world of pain. A compromised key can lead to everything from data compromises, unauthorized modifications, losses, and theft to costly data breaches and compliance issues. Not only will your reputation suffer potentially irreparable harm, but your customers may, too. Needless to say, this will have a devastating effect on your bottom line.

    This is why it’s essential to carefully manage and monitor your PKI. This entails keeping visibility of your IT environment and the certificates and keys within it, managing who have access to your keys and resources, and rotating out certificates and keys as they expire or, on the rare occasion, become revoked.

    A carefully managed PKI helps you achieve digital trust and makes for a healthy and successful business.

    Final Thoughts on a Digital Signature vs Digital Certificate

    As you’ve learned, digital signatures and certificates aren’t so much an either/or kind of thing: you need both to secure your organization and its data. To assert your digital identity, you need to use a digital signature. In order to create a digital signature, you need to have a digital certificate. But when creating your digital certificate, a reputable third party (i.e., a CA) must use their trusted root’s digital signature to offer assurance that your organization has been properly vetted and can be trusted… it goes on and on.

    If you want your organization to avoid making the next data breach headline, you must secure your digital identity, data, and communications. Carefully manage and use digital certificates and signatures together to achieve this goal.

     

  • SBOM: An Up-Close Look at a Software Bill of Materials

     

    A software bill of materials lists the “ingredients” in a software product, making it easier to identify and avoid security risks

    Unless you’ve been living under a rock the past few years, you’ve likely at least heard of Log4j. This is an Apache open source library that’s commonly used in just about everything Java-related online. Unfortunately, in late 2021 the logging package was discovered to be critically vulnerable to remote code execution attacks, meaning an attacker could exploit it to install malware (e.g., ransomware) onto vulnerable systems and inject larger networks.

    Cloudflare CEO Matthew Prince reported on Twitter that there were 400 confirmed exploit attempts per second. But that’s just one estimate — according to The Washington Journal, Akamai Technologies said it observed 10 million such exploit attempts per hour. Research from Check Point also showed that the attackers were rolling out new variants of the exploits — more than 60 in under 24 hours.

    That’s a lot of exploits and a lot of variations to boot. Considering that the Log4j vulnerability affected major companies like Amazon, Apple, and IBM, it’s no surprise that it had companies globally worried.

    But what makes the situation particularly concerning is that many companies weren’t aware that the products they use contained such vulnerable elements. If only there was a way that organizations could know exactly what components are part of the software they use… Oh, wait, there is: they could use products that come with a software bill of materials (SBOM).

    But what is a software bill of materials and how can it help organizations mitigate some of the cyber risks facing their organizations and networks?

    Let’s hash it out.

    What Is a Software Bill of Materials (SBOM)?

    A software bill of materials is a list of the base elements (such as code libraries) used to create a product. Basically, it provides details and information that outline the relationships between the various elements of the software in your supply chain. The National Telecommunications and Information Administration (NTIA) has a bit more technical definition for an SBOM, describing it as “a nested inventory for software, a list of ingredients that make up software components.” It includes everything from version information and what companies created those elements.

    Putting it more simply, SBOMs enable companies to know exactly what goes into their software — ideally, so they can keep a close eye on any dependencies. So, going back to the Log4j example, if you’re using software that includes the vulnerable library, you would know instantly because Log4j would be listed in the SBOM. You could reach out to your vendor to ensure they’re providing a patch using an updated version of Log4j. But you can’t assess or mitigate specific cybersecurity risks if you don’t know they exist. This is where an SBOM can help.

    An analogy that’s commonly used to describe these lists of components is the ingredient labels on packaged food items. (We’ll speak more to that in a minute.) The purpose of an SBOM is to create transparency and help companies identify dependencies in their software supply chains. This is because, as a purchaser, you’re supposed to receive or be able to access SBOMs for products you purchase. This way, you know a good amount of information about your supply chain.

    SBOMs are something that can be used to address a wide variety of security issues for everything from software to IoT devices.

    Even the U.S. Government Encourages Using SBOMs to Improve Security

    In fact, the May 2021 U.S. Executive Order (EO 14028) on Improving the Nation’s Cybersecurity calls upon the use of SBOMs to help strengthen the defenses of U.S. federal information systems. (Government agencies are now required to collect them from software suppliers.) The National Institute of Standards and Technology (NIST) developed the Secure Software Development Framework (SSDF) to aid this initiative, and it requires software bill of materials information to be included.

    NIST says that SBOMs are complementary to other software security processes; they’re not meant to replace other security-related functions such as cybersecurity supply chain risk management (CSCRM) activities.

    What Types of Information SBOMs Should Include

    In its 2021 Multistakeholder Process on Software Component Transparency document, NTIA explains that an SBOM typically includes specific information about a product’s baseline components:

    • Author’s Name
    • Supplier name
    • Component name
    • Version string
    • Component hash (yup! Cryptographic functions play a key [excuse the pun] role here, too)
    • Unique identifier
    • Dependency Relationship
    • Timestamp

    For a complete list of minimum requirements, check out NTIA’s SBOM Minimum Elements Report. It breaks down the minimum elements that should be addressed in an SBOM into three main categories:

    1. Data fields,
    2. Automation support, and
    3. Practices and Processes.

    Do SBOMs have to be created at the time you’re developing your software? Not necessarily. You also can create SBOMs retroactively. The only thing to note about that is that it might not be as complete as an SBOM that’s generated as part of your software development life cycle (SDLC) process.

    SBOMs Are Typically Meant to Be Read By Machines, Not People….

    An SBOM isn’t something that just anyone can look at and read easily; it’s presented in one of a few standardized formats that are readable by computers (but not human beings, unless you know what to look for) to improve integration and automation. These three standards (listed in alphabetical order) include:

    • CycloneDX, which also works for software-as-a-service (SaaSBOM), hardware bill of materials (HBOM), and other uses. The file format for this type of SBOM is .xml.
    • Software Identification (SWID), which is also an international open standard (ISO/IEC 19770-2:2015, updated 2021). Acceptable file formats are .json and .xml.
    • Software Package Data eXchange (SPDX), which is an international open standard (ISO/IEC 5962:2021). Acceptable file formats include .json, .spdx, .rdf .xls, .xml, and .yml.
    Image caption: A screenshot from NTIA that we’ve highlighted to illustrate the different informational requirements that a software bill of materials must include. Original image source: NTIA.

    Who a Software Bill of Materials Benefits (Spoiler Alert: Everyone)

    According to the White House’s Executive Order, SBOMs benefit virtually everyone who develops, manufactures, purchases, or operates software or devices that use said software. But the truth is that a software bill of materials also indirectly benefits the consumers who are served by these companies and service:

    “An SBOM is useful to those who develop or manufacture software, those who select or purchase software, and those who operate software. Developers often use available open source and third-party software components to create a product; an SBOM allows the builder to make sure those components are up to date and to respond quickly to new vulnerabilities. Buyers can use an SBOM to perform vulnerability or license analysis, both of which can be used to evaluate risk in a product. Those who operate software can use SBOMs to quickly and easily determine whether they are at potential risk of a newly discovered vulnerability.”.

    Yup. While SBOMs are typically promoted as being good for software buyers and operators, the truth is that they’re also useful for broader audiences. So, you see, it’s good for your organization regardless of where you fall in the supply chain.

    But now that we know what an SBOM is in a general sense, let’s take a closer look at this security tool and how it aids your organization’s software supply chain.

    A Look at How a Software Bill of Materials Breaks Things Down Within the Supply Chain

    Your software supply chain comprises everything from where the individual components came from that are used to create the products you use and how they’re manufactured, distributed, and supported. Some categorizations of the supply chain talk about custom code, third-party components, development and building environments, delivery, etc. Basically, it’s all about sourcing your components (internal or third-party dependencies), building your software, storing and deploying it, and providing ongoing support (via patches) while it’s being used by the intended users.

    However, to simplify things a bit more, we’re going to look at what the software supply chain ecosystem looks like based on a traditional supply chain (based on information shared in NTIA’s SBOM explainer video):

    A example of a software supply chian ecosystem that's based on a traditional supply chain to make it a bit easier to explain.
    Image caption: A basic diagram that illustrates the software supply chain ecosystem and some of the parties involved in it.

    Let’s imagine, for a moment, that you’re an IoT device manufacturer that uses third-party software as part of your supply chain. This is how the above breakdown would play out with regard to you and your business:

    • Source parts refer to all the base elements used to create the product.
    • Compound components refer to any elements in the final product that are created using other elements (e.g., a third-party’s library or open source code). Not all software manufacturers provide information about what these components are.
    • The final assembled product (your software) is the end product created when you combine all of the parts.
    • Operator(s) or vendor(s) is the term that refers to your direct customers or service providers that use your product.
    • Consumer(s) refers to the people that your customers use your product to provide services to.

    An SBOM Is Like the List of Ingredients You’d Find in Your Favorite Foods…

    When you’re at the grocery store, do you stop to read product nutrition labels and ingredient lists? If you’re like me, you do because you want to know exactly what you’re putting into your body.

    It’s a good idea to take a similar approach when adding software and devices to your network. If you want to keep your network secure, then you’ll want to check every device, software, or system carefully you connect to it for known vulnerabilities. Knowing what libraries, drivers, operating systems and open source resources are used goes a long way in helping you assess and mitigate vulnerabilities.

    Let’s consider a quick example with one of my favorite special occasion meals: Fettucine alfredo. Say, a friend is having a small get-together at her house and I decide to bring over a dish of homemade fettuccine alfredo for the occasion to share. Sounds great, right? It is, so long as no one has any food allergies to any of the ingredients I’m using in my dish.

    But how can someone tell whether there might be something in my fettuccine alfredo that might cause an issue? Let’s first consider the list of ingredients. My fettuccine alfredo recipe is pretty simple as it contains several basic ingredients:

    • Heavy whipping cream
    • Homemade salted butter
    • Freshly grated Parmesan-Reggiano cheese
    • Freshly grated Pecorino-Romano cheese
    • Garlic
    • Salt
    • Black pepper
    • Italian parsley
    • Homemade gluten free fettuccine pasta

    If I were to break up this item, we’d be looking at the following breakdown of items:

    A screenshot of a table that lists the compound ingredients and a handful of base ingredients used to create Casey's gluten free fettucine alfredo dish

    Looks simple enough, right? Not quite… There’s more to it because of the “hidden ingredients” that people might not know about if they aren’t disclosed.

    Some Ingredients Are Made Up of Other Unknown Ingredients

    An example food nutrition and ingredient label that shows how the base ingredients and compound ingredients are represented
    Image caption: An example food nutrition and ingredient label.

    A few of these items — the two cheese and the gluten free flour — are created through manufacturers whose products I like and trust. So, knowing this, let’s consider the supply chain for these items — particularly the compound components. These items may have other additives that I might not be aware of unless I stop to read the product label. Let’s consider a quick example using parmesan cheese.

    The ingredients for the brand of parmesan cheese I typically use contains cultured cow’s milk, enzymes, and salt. (Note: If I bought the pre-grated variety, additional components would be added, such as cellulose and natamycin — this is why I buy the blocks of cheese and grate them myself!) So, in this case, that means the enzymes and cultured milk need to be added to my list of ingredients.

    Likewise, if I looked at the ingredient list for the Pecorino-Romano cheese or the gluten free flour I’d use, there would be several additional items I’d need to add to my list of components. And it would also be important to know where the ingredients the manufacturers used actually came from. For example:

    • The Pecorino-Romano cheese I use is imported from Italy and it contains sheeps milk and rennet.
    • The flour includes multiple other ingredients — sweet white rice flour, whole grain brown rice flour, potato starch, whole grain sorghum flour, tapioca flour, and xantham gum.

    This means my ingredient list now looks more like this:

    A screenshot of a table that lists the base and compound ingredients used to create Casey's gluten free fettucine alfredo dish

    Why You Need to Know Which Ingredients Are Included in Your Software

    See how much longer the list of ingredients became now that we’ve added all of these “hidden” ingredients? Now, ask yourself what would happen if one of your friends was allergic to milk, tapioca flour, or eggs but you didn’t know it. If they didn’t know those ingredients were included in the meal, it could lead to a potentially serious medical emergency, depending on the severity of their allergic reaction.

    Likewise, similar concerns apply to your software and hardware devices. While the concern isn’t a food allergy or medical concern necessarily, not knowing what’s included in your software supply chain leaves your organization, network, and customers at risk. Knowing the A-Z of your software supply chain helps you stay abreast of any potential vulnerabilities and exploits you need to address before bad guys use them to attack your network and organization. This is crucial for risk analysis and mitigation activities, where you need to know how and where your systems are vulnerable.

    The truth is that it’s rare to find a company that builds its software or hardware components entirely from scratch. (Doing so is just too complex, costly, and time consuming.) Instead, they integrate third-party and open source elements such as frameworks and libraries. When you consider that these components often operate with the same permissions as the software they’re a part of, it means the risk can be significant.

    SBOMs help you have a better understanding of your supply chain and everything involved in it. They also help you better manage and mitigate risks by using them to analyze known vulnerabilities. This is why it’s best for them to be stored in a centralized repository that applications and systems can easily access and use.

    Can’t a Software Bill of Materials Be Faked?

    As with any electronic file, yes, there’s always a risk of that happening. However, there are safeguards that could be used to prevent digital tampering and to prove something is legitimate. One such method is to digitally sign your file before releasing it with your software. A digital signature is a way to simultaneously show that your file is authentic and hasn’t been tampered with since it was signed.

    Is a digital signature required for use with SBOMs? No. But as Dean Coclin (CISSP) points out, one good option is to “use a cloud-based code signing service, which allows for uploads of code (or the hash) to be signed by the service and returned to the developer.”

    Final Thoughts on SBOMs (And Why They Should Be Part of Your Risk Management Strategy)

    Trying to mitigate risks for your software without knowing all the different components nested within it is like going to a dinner party when you have a severe peanut allergy and not bothering to ask if any of the dishes contain nuts. It’s not a smart practice and puts you at risk of a severe medical — err, cybersecurity episode. Instead, ask those questions and avoid the potential headaches, non-compliance issues, financial penalties, and lawsuits that you otherwise may face.

    Nowadays, it’s uncommon for software developers to write all of their code from scratch. It’s far more common for devs to integrate open source code into their products because it’s cheaper and easier. As the saying goes: Why reinvent the wheel?

    Making software bills of materials a standard component of every piece of software is a smart move. SBOMs provide the added layer of transparency organizations need to keep their data and networks secure and aid in making the vulnerability assessment and mitigation process a lot easier.

    The next time you’re shopping for new software, be sure to speak with your vendor to see if their products have SBOMs available. Don’t be surprised if they don’t but be sure to ask anyway to make it clear that this is something you want to see as a software purchaser or operator.

     

    Article published on TheSSLStore by Casey Crane

  • HTTP vs HTTPS: What’s the Difference Between the HTTP and HTTPS Protocols?

     

    The difference between HTTP and HTTPS can be the difference between your business being successful or suffering a data breach. Let’s quickly highlight the key differences you should know about these two foundational connection types

    HTTP, or hypertext transfer protocol, is the default connection type that websites revert to without a special security tool called an SSL/TLS certificate. See that padlock near the top of your browser window? That means you’re using HTTPS, which is a secure connection (hence, the “S” at the end). If you don’t see one, it means you’re using an insecure (unprotected) connection that leaves your data vulnerable. (In a nutshell, that’s the difference between HTTP vs HTTPS.)

    Unless you like handing out your most sensitive data like it’s Halloween candy, you’ll want to ensure you’re using HTTPS for all of your website connections.

    But aside from adding an extra letter at the end of the acronym, what is the difference between HTTP and HTTPS? Don’t worry, we’ll cover everything you need to know in just a few moments.

    Let’s hash it out.

    A 2-Minute Overview of HTTP vs HTTPS and Their Differences

    HTTP and HTTPS are both internet connection protocols — meaning they’re sets of rules that govern how you transmit data remotely between parties. (For example, between your website and the customers who connect to it.)

    The difference between the two boils down to data security: One secures data in transit (HTTPS) using verified identity and public key cryptography while the other does not (HTTP). This means that while data is transmitting via HTTP, it’s vulnerable to interception attacks (i.e., man-in-the-middle attacks). HTTPS is basically HTTP with a little something “extra.”

    HTTPS = HTTP + Transport Layer Security (TLS)

    TLS is the successor of SSL, which you’ve likely heard of, and requires a site owner to install a special digital certificate called an SSL/TLS certificate (AKA a website security certificate). TLS combines verified digital identity and encryption with the traditional HTTP request and response messages to make them more secure. This way, any unintended users can’t intercept and read those messages in transit.

    We won’t get into all of the technical nitty-gritty of how HTTPS works here — there’s not enough time for that in this article. Instead, take a look at the following illustration to see the difference between HTTP and HTTPS when it comes to securing website connections:

    Image caption: A set of diagrams that display the difference between HTTP and HTTPS to secure data in transit.

    Here’s a quick-glance guide that highlights the differences of HTTP vs HTTPS:

    Type of Protocol HTTP HTTPS
    What It Is (Technical Definition) Hypertext transport protocol — this is a set of rules for transmitting data in plaintext. Hypertext transport protocol secure — this set of rules teams encryption with verified digital identity to encrypt data in transit. This means your data is secure against unauthorized access.
    Simplified Definition An HTTP connection is like sending a postcard that’s open for everyone to see and is susceptible to unauthorized modifications. An HTTPS connection is like sending a coded (enciphered) message that only you have the key for, and that’s sealed in a envelope with a wax stamp to protect the integrity of the message.
    Requests and Responses Request and response data for your website is not encrypted. Uses transport layer security (TLS), formerly secure sockets layer (SSL), to encrypt data to secure data in transit.
    Port Number(s) Port 80 Port 443
    How to Enable It Doesn’t require anything special; this is the default communication protocol for data transfers. This is what servers revert to when secure connections fail, or website security certificates aren’t installed on the server. Requires installing an SSL/TLS certificate on your server that contains verified info about your domain and organization.
    How You Know It’s Enabled Security icons display in your browser’s address bar to indicate your website connection isn’t secure (icons vary by browser): A padlock icon with a line marked through An exclamation markA padlock with an exclamation mark and “HTTPS” crossed out with strikethrough text   You’ll also see “http://” at the beginning of the website’s URL. (This may require you to click on the URL to get it to display.) A locked padlock icon that communicates that the website (or, more accurately, its connection) is secure.   You’ll see “https://” display in the web address bar as well. (This may require you to click on the URL first to get it to appear.)
    Security Risks Vulnerable to man-in-the-middle (MitM) attacks that enable cybercriminals to intercept your communications and steal, manipulate or delete your data in transit. The recommended security mechanism to protect your data in transit against MitM attacks and other related security issues.
    Performance Speeds HTTP is faster than HTTPS, but the difference is negligible and doesn’t outweigh the security benefits of the latter. HTTPS is slower but more secure than HTTP. However, HTTP/2, which compresses data and supports multiplexing, is faster and requires the use of HTTPS.

    Why You Should Use HTTPS Instead of HTTP

    When users visit websites loading via HTTP, they’ll see “Not Secure” messages that caution proceeding any further. As you can imagine, these warnings can have negative effects on your reputation and relationship with customers. After all, why should they trust you when you’re making no visible effort to keep their data secure? They shouldn’t, and rightfully so. This is why you need to step up and do something about it to make your website more secure.

    Before the internet, you physically had to meet up with someone to securely exchange data. (Think of clandestine meetups in classic spy movies). Otherwise, you’d risk a message being intercepted where someone could make unauthorized changes to its contents, and you’d never know the difference.

    In an age of near-instantaneous communications, these time-consuming and expensive rendezvous are no longer necessary. Public key encryption, which is at the core of what makes HTTPS possible, enables people the world over to engage in secure remote communications.

    Enabling HTTPS on your website is a smart move for several key reasons:

    • Resolves the security issues plaguing HTTP requests and responses
    • Requires the verification of your site’s digital identity
    • Gets rid of the ugly “Not Sure” and “Insecure Website” warnings that drive away customers

    How HTTP & HTTPS Sites Display in Your Browser (Chrome, Firefox, and Microsoft Edge)

    Look at the web address bar in the Google Chrome browser: Is there a locked padlock icon displaying? How about an “https://” displaying in the URL itself when you click on it? If you answer yes to either (or both) of these questions, great! This means you’re using a secure, encrypted connection.

    A screenshot of Hashed Out, which loads using a secure HTTPS connection


    Image caption: A screenshot example of a secure website that’s using an HTTPS connection. This is demonstrated through the inclusion of the security padlock icon to the left of the website URL.

    If your answer is no because you’re not seeing a locked padlock in Chrome but are seeing an exclamation point (or a padlock with an exclamation point), it means the website is using HTTP and isn’t secure:

    A screenshot of an example web page that's loading via the insecure HTTP protocol
    Image caption: A screenshot of an insecure (HTTP) website as it displays in Google Chrome. This exclamation point is meant to catch the user’s attention and warn them that the website is insecure.
    A screenshot of BadSSL.com loading an example that shows an expired SSL/TLS certificate error with a
    Image caption: A look at how Google Chrome displays HTTP error messages (in this case, how an expired SSL/TLS certificate displays).

    Unsurprisingly, browsers like to put their own spins on things. Mozilla’s Firefox browser takes a slightly different approach, displaying the padlock with a red line through it in the address bar:

    A screenshot of a real-world example that shows an HTTP (insecure) site loading in the Firefox browser
    Image caption: A screenshot of a website that’s loaded via an insecure (HTTP) connection on Firefox. The same concept applies here as with Chrome — only this time, it uses a red slash to indicate the website’s insecurity.

    Similar to Google Chrome, Microsoft’s Edge browser also wants it to be obvious that you’re using an insecure website. They use virtually the same UI with a combination of colored exclamation points and strikethrough text to catch your attention — they just don’t use as much red as Chrome for SSL/TLS related error messages. For example, check out this screenshot from an example insecure website:

    HTTP vs HTTPS graphic example: An insecure website loading in Microsoft Edge.
    Image caption: A screenshot of a website loaded via an insecure (HTTP) connection in the Microsoft Edge browser. This is like the love child of Chrome and Firefox’s warning indicators: It has the exclamation and “Not Secure” message like Chrome but the red coloration like the slash mark in Firefox.

     

    Final Thoughts on HTTP vs HTTPS Differences

    It’s easy to see why enabling HTTPS on your website is a no-brainer. While HTTP is technically faster in terms of performance, that gets blown out of the water when you consider the security advantages that its more secure counterpart offers. HTTPS pairs verified digital identity with encryption to ensure that only the right party is able to access your secure data. HTTPS clearly wins the “HTTP vs HTTPS” battle.

    In the overwhelming majority of situations, there’s no excuse for using an insecure HTTP connection for your website. The few-and-far-between exceptions would be websites where no sensitive information is requested or shared by site users (i.e., informational websites, but even then there may be an admin login URL). If your organization has an ecommerce store, lets users log in, or otherwise collects sensitive data, then you’d better secure your website ASAP with HTTPS.

    Any delay further leaves your (and your customers’) data open to theft, modification, and other issues.

     

  • 5 Examples of When to Use a Digital Signature Certificate

     

    Whether you’re a software creator or sales manager, digital signatures are essential to the security and authenticity of your data. Here are several of the ways that you can use digital signature certificates to enhance trust in your organization

    We live in a world where you really have to question everything: is this email from your boss legitimate? Is the software update you want to install authentic, or is it a trojan that’s waiting to infect your device? When you log in to your favorite eCommerce website, how do you know it’s legitimate?

    A digital signature certificate could hold the answer in all of these cases. These tiny data files help your web or email client verify that the file or other party you’re connecting to is trustworthy and authentic. This way, you don’t inadvertently share your sensitive login information or other data with cybercriminals.

    But how can you use digital signature certificates to your advantage? We’ll go over all of that in just a few moments. But first, we think it would benefit our newer readers to briefly recap what a digital signature is and why you need a digital signature certificate to create it.

    Note: If you’re already well acquainted with digital signatures and digital signature certificates, jump ahead to our list of digital signature certificate use cases.

    What Is a Digital Signature? A Quick Recap

    Digital signatures, also called public key signatures, are a cryptographic method of showing who created a digital asset and ensuring the item hasn’t been changed by another party. Examples of such assets include emails, PDFs, Word files, software application codes, etc. Applications frequently use visual marks of some kind (e.g., a ribbon mark in Microsoft Outlook) to represent digital signatures.

    These signatures are trusted because you need to have a special file called a digital signature certificate in order to sign them digitally. But before you can get this digital certificate, a publicly trusted third party (called a certificate authority or CA) has to carefully vet your identity. Once you receive and start using your digital signature certificate, it proves that whatever you sign is authentic because it was created and signed by you, and your identity has been validated.

    Digital signatures are a type of electronic signature. But unlike regular electronic signatures, which generally look similar to handwritten signatures, digital signatures might not look anything like traditional signatures. Here are a few quick examples to showcase the difference between electronic and digital signatures:

    Image caption: A visual comparison that shows the difference between some of the visual indicators that may display for an electronic signature (left) and a digital signature (right).

    How Digital Signatures Are Created

    To create a digital signature, you first need to have a digital certificate in hand. A digital certificate is a small data file that contains verified, identifying information about you or your organization. (This is the main info that displays to users.) But that’s not all that’s required. Without getting too technical, digital signatures are created by applying two cryptographic tools to the data you wish to protect:

    • A special cryptographic function (called a hash function or hash algorithm) — This creates a hash value (a mishmash of letters and characters) of a fixed length, which masks the true size of the input and ensures the integrity of the data.
    • A private key, which encrypts the hash value — When the recipient receives or downloads the file, they can decrypt it using the signer’s public key. This key ensures only the intended user can read the data.

    Digital Signatures Enable You to Prove You and Your Files Are Legitimate

    A digital signature validates your identity to other parties and ties it to whatever you’ve created and signed. The important takeaway here is that digital signatures offer two key qualities that you won’t find in regular electronic signatures:

    • Authentication — This means you can prove that you or something you created is legitimate.
    • Non-Repudiation — This ensures recipients that you, and only you, created or signed the item in question; that an imposter didn’t fraudulently make it.

    Historically, if you wanted to prove that you’re the legitimate signer of a document, you’d have to meet up with a public notary to have them observe you signing it. This process required providing the notary with verifiable proof of identity — this is typically some form of ID from a trusted entity (i.e., your driver’s license or ID issued by your state or country’s government).

    This is fine if you’re physically located in the same area where it’s easy to meet up to carry out this process. But what if you’re trying to do business with someone in another country? Meeting up face-to-face then becomes a lot more complicated and costly.

    So, where do you find digital signatures? All over the place, honestly. You’ll find digital signatures used in everything from website connections to document signing.

    You Need a Digital Signature Certificate to Use Your Digital Signature

    Digital signatures are typically stored in special files known as digital certificates. For the sake of this article, we’ll call them digital signature certificates. Digital signature certificates are small digital files that enable you to use those signatures online.

    A few examples of these digital signature certificates include:

    Of course, there’s another type of digital certificate that uses digital signatures: an SSL/TLS certificate. This file is what enables you to prove that your website is legitimate because it’s been signed off on by a trusted CA (like DigiCert or Sectigo). But we’ll talk more about that in a little bit.

    Okay, now that we have all of that out of the way, let’s jump right to what you need to know about how you can use each of these digital signature certificates…

     

    5 Digital Signature Certificate Use Cases For Your Business

    For virtually all of our readers, you’re likely already using digital signature certificates in one way or another (you just might not know it). However, there may be some use cases that you’re not as familiar with or aren’t sure how to implement within your IT environment. We’re here to explore those and more:

    1. You Need a Way to Show Your Microsoft Office and PDF Files Are Authentic

    A screenshot of a Microsoft Word digitally signed document
    Image caption: A screenshot of how the digital signature information displays in a digitally signed Microsoft Word document.

    Nowadays, you practically can’t do anything within your business without using Word, Excel, or PDF files. Of course, you’d like to assume that someone will send you only legitimate files via email. However, the reality isn’t as pretty. While it may be true, say, 90% of the time, the remaining percentage is enough to crack those rose-colored glasses.

    As recent cyber security statistics and cyber crime statistics show, the threat landscape continues to change. New threat actors seemingly arrive on the scene almost daily and attack methods evolve with them. For example, SonicWall reports the prevalence of malicious Microsoft Office files decreased 64% in 2021; malicious PDFs, on the other hand, increased 52%.

    So, how can you show users that your documents and files are legitimate? Digitally sign them first using a document signing certificate. For example, this is what it looks like when you sign a Word document using a document signing certificate:

    Here’s what it looks like when you sign an Adobe PDF file with an applicable digital signature certificate:

    An example digital signature certificate's display for a PDF document
    Image caption: A screenshot of how a digital signature’s information displays in a digitally signed Adobe PDF file.

    2. You Want to Eliminate Warning Messages When Users Download Your Software

    SonicWall’s 2022 Cyber Threat Report data shows that malicious executables represented a whopping 30.27% of the cybersecurity company’s malicious file detections. As such, as a software developer or publisher, you need to have a way to show that:

    • Your software is authentic,
    • It’s actually from you, and
    • No one’s modified it.

    You can do this using a code signing certificate. These certificates are typically offered with two options of validation levels: organizational (i.e., standard) and extended. (Note: Some certificate authorities offer individual validation as well.) When you use this type of digital signature certificate to sign your software, you attach your organization’s verified information to the file regardless of the validation type you choose.

    A side-by-side comparison of an unsigned executable versus a digitally signed executable
    Image caption: A set of screenshots that show the difference between how files display when they’re digitally signed (right) and are not digitally signed (left). A digital signature certificate lets you display your verified publisher name on the installation prompt screen.

    Both types of certificates are trusted automatically by browsers and operating systems. The big difference between the two validation levels is that Windows Defender SmartScreen requires an EV certificate if you don’t want an ugly warning message to pop up:

    A Microsoft Defender SmartScreen warning message
    Image caption: A screenshot of the warning message that Windows Defender SmartScreen displays when you try to install unsigned software.

    3. You Want to Give Customers and Prospects a Reason to Trust Your Website

    Trust is hard to earn yet fragile as glass. Once you earn your customers’ trust, you need to do everything possible to protect it. Having a way to prove that your website — your brand’s digital representation — is legitimate is essential to that mission.

    Every time you visit your favorite website, the server sends your browser a file (i.e., an SSL/TLS certificate) containing crucial identifying data that proves you’re connecting to the right server. This website security certificate is issued and digitally signed by a publicly trusted entity known as a certificate authority (CA). The CA’s trusted root

    A digital signature certificate's chain of trust
    Image caption: A screenshot of the certificate authority’s chain of trust, which showcases the digital signatures of each certificate that signs the next to attest to its authenticity.

    The CA’s digital signature means that this globally trusted entity is vouching for you, saying that you’ve, essentially, been vetted and are trusted. Having such a way to prove your organization’s authenticity is particularly crucial when you consider recent data from Bolster shows that their systems detected nearly 10.7 million phishing and scam pages in 2021 alone. To put this in more relatable terms, it means Bolster’s team detected an average of 29,190 fraudulent pages every day throughout the year.

    Want your authentic website to stand out from the sea of fraudsters’ sites? Then slap your vetted and validated identity on it by installing an SSL/TLS certificate right away. In addition to asserting your digital identity, SSL/TLS certificates enable users to communicate securely with your site. If you install an extended validation (EV) code signing certificate, then you take your digital identity to another level by displaying your verified company information upfront. This way, users don’t have to dig around your certificate info to find the details.

    A screenshot of The SSL Store's home page and SSL/TLS digital signature certificate information displaying
    Image caption: A screenshot of the verified company information for TheSSLstore.com.

    4. You Need to Prove to Recipients That Your Email Communications Are Authentic

    Phishing is one of the top cyber attack methods used by cybercriminals. Verizon’s 2022 Data Breach Investigations Report (DBIR) data shows that email is one of the two leading attack vectors used in known data breaches. Furthermore, their report indicates that 75% of the malware the median organization received in 2021 came via email.

    Sure, you can — and should — train your employees to recognize the threats associated with phishing attacks and social engineering. But it doesn’t hurt to add another more technical layer of security to the equation; this is where digital signature certificates for email come into play.

    These certificates are known as email signing certificates or S/MIME (single/multi-purpose internet mail extension) certificates. They allow you to attach your digital signature to messages so your recipients can confirm they came from you. These certificates offer the added benefit of enabling you to encrypt your emails as well. This helps to provide end-to-end encryption by securing the emails before they leave your email server.

    Here’s a quick look at what a digitally signed email looks like to your recipient:

    A screenshot that shows an email message that was signed by a digital signature certificate
    Image caption: The screenshot above shows both the verified “signed by” information and the ribbon icon that indicate I’d digitally signed and sent the email to one of my colleagues.

    5. You Want to Authenticate Without the Risks Associated with Traditional Passwords

    There’s no such thing as a perfect authentication method; an enterprising cybercriminal will inevitably find a way to authenticate as you (fraudulently) if they’re truly motivated. But the goal is to make yourself as difficult a target as possible; this way, 99% of cybercriminals will give up and move on to the next target. Make yourself one of the hardest-to-reach fruits on the tree instead of one of the easy-to-steal, low-hanging fruits.

    This is where a type of digital signature certificate, known as a client authentication certificate, can come in handy. A client authentication certificate enables you to authenticate without having to type in a username or password. Instead, you have a PKI certificate installed on your device, enabling you to authenticate automatically.

    Why is this necessary? ForgeRock reports that 50% of cyber attacks they studied were due to unauthorized access through various account compromises. Of course, there are many ways accounts can become compromised. One of the most common methods is phishing, which involves an attacker stealing a user’s login information using social engineering tactics.

    Using PKI-based authentication instead of a username-password combination means you no longer have a password that can be phished or stolen via malware. You simply go to the web app or system you have permission to access, and the authentication “magic” happens on the backend automatically. No muss, no fuss.

    A screenshot of a digital signature certificate's information that displays for a client authentication certificate
    Image caption: An example of a client authentication certificate. This type of digital signature certificate enables a user to authenticate automatically without using traditional login credentials.

    Final Takeaways on Digital Signature Certificates

    It’s now more important than ever to secure your organization’s digital identity and data. Choosing to use a digital signature certificate to secure your digital assets is the difference between sending or receiving authenticated communications or files instead of unauthenticated (and potentially dangerous) ones.

    To get a digital signature certificate for your website, emails, documents, or software:

    • Evaluate what you need to secure and authenticate.
    • Go to your favorite CA or authorized reseller’s website.
    • Choose the certificate(s) based on the type(s) of coverage and validation type.
    • Purchase your certificate(s).
    • Generate a certificate signing request (CSR) for domain validation (DV) and organization validation (OV) certificates, if applicable.
    • Provide the CA with the necessary organizational information to complete validation.
    • Collect your digital signature certificate and install it on your server, device, or client.
    • Start using your certificate right away!

     

    Article published on TheSSLStore by Casey Crane

  • Email Security Best Practices – 2022

    Email Security Best Practices – 2022

    91% of cyber attacks start with an email.

    Email is by far the most commonly exploited attack vector. Each year countless organizations lose millions of dollars over lapses in email security.

    And for small and medium-sized businesses, the damage can prove fatal. Recent studies have found that 60% of SMBs that get hit by a cyber attack fold within six months of the incident. And two-thirds of potential victims WOULD go under if they were successfully attacked.

    So, something as trivial as learning to spot a phish can have major ramifications on your bottom line and the health of your business.

    And we’ve come a long ways from the days of those poorly-worded Nigerian prince emails. It’s still unclear whether or not anyone ever clicked on those in the first place (someone must have), but nowadays phish are difficult to distinguish from the real thing. According to one survey, 97% of respondents couldn’t spot a phishing email.

    The criminals use social engineering to produce believable scenarios, impersonating well-known companies or vetting potential targets on LinkedIn to tailor their approaches.

    And nobody is safe, from the lowest level administrative employees on up to the C-Suite – even partners can be targeted in an effort to get at your organization.

    As email becomes increasingly critical to business success, however, a stronger set of email security best practices is recommended. They can be summarized as follows:

    1. Train employees on email security best practices.
    2. Create strong passwords.
    3. Don’t reuse passwords across accounts.
    4. Consider not changing passwords regularly.
    5. Use multifactor authentication (MFA).
    6. Take phishing seriously.
    7. Be wary of email attachments.
    8. Don’t click email links.
    9. Don’t use business email for personal use and vice versa.
    10. Avoid public Wi-Fi.
    11. Use email security protocols and tools.

     

  • Is Free SSL Right for Me?

    Is Free SSL Right for Me?

    Is Free SSL Right for Me?

    When free SSL certificates came on the scene in 2016, bloggers and business owners alike cheered. And, now that Google is serving up all unencrypted pages with a “Not Secure” warning, they offer a fast, economical option for securing your website.

    Free SSL certificates provide peace of mind that all information that’s shared is encrypted and protected in transit. This is an essential step in your website security. But, depending on the type of site you have and your goals—you may want to consider upgrading to a paid business-validated SSL certificate.

    Here are a few things you’ll want to think through before you decide if free is the way to go.

    • Identity Matters—Free SSL certificates provide encryption and validate you own your domain. This is probably sufficient if you have a blog or small personal non-business site. But, today’s savvy visitors are painfully aware of how often data gets into the wrong hands. Business-validated SSL certificates require more extensive vetting by the Certificate Authorities (CAs), so your visitors feel confident you’re a legitimate business they can trust.
    • The Power of Site Seals—You may be surprised to know that, according to monetizepros.com, a whopping 61% of shoppers decided not to buy because a site was missing a trust seal. Business-validated SSL certificates, specifically Extended Validation (EV), proudly display a dynamic site seal that gives your visitors the reassurance they’re looking for.
    • What If Protection—Sure, “what if” may never happen. But, if you’ve ever filed an insurance claim for your house or car, you know protection for the unexpected when you do need it is worth every penny. If something goes wrong with your certificate, even if it’s not your fault, business-validated SSL certificates include a warranty that protects you against excessive liability.
    • Expert Guidance—Generating CSRs, validating, installing and managing SSL certificates, not to mention compliance, can be confusing, even with free versions. You never know when you’ll need a team of experts to call on for guidance. What if another Heartbleed bug came along? Would you be able to fly solo and know exactly what to do? If you’re like most organizations, the answer is no. Business-validated SSL certificates provide the support and expertise you need, when you need it.

    Choosing the right SSL certificate is an important decision that has daily ramifications on your reputation, engagement, conversion and overall online success. On the web, trust and perception are everything, so it’s important to review your options and make an informed choice that fits your budget and business goals.