Category: SSL Certificate

  • The Rise of Zero Trust: Threats Are No Longer Perimeter-Only Concerns

    The zero-trust strategy approaches security from the mindset that no one — not even your internal network users — can or should be trusted automatically. Here’s why zero trust security is picking up traction with organizations and governments globally…

    … It’s not paranoia when someone really is out to get you. And if you’re an organization or business, you can virtually guarantee that someone, somewhere has you in their crosshairs. Verizon reports 82% of data breaches involve the “human element” — including everything from phishing and social attacks to general errors and misuse — so, it’s clear why all organizations need to change how they approach cyber security.

    This is why the U.S. Department of Defense published information regarding plans to shift its network to a “zero trust architecture” by 2027. In its Zero Trust Strategy and Roadmap document, the federal defense agency shared its goals about what it aims to achieve and what its vision is for the future: implementing stronger defenses against cyber attacks via a dynamic and adaptive approach (zero trust).

    This move toward zero trust security has been picking up traction with businesses and other organizations globally over the past several years. It contrasts the traditional notion that cyber security efforts should focus on external threats and hardening your perimeter defenses to protect against threats outside your network. Imagine the cyber security incidents (and resulting data breaches) that could have been avoided if the targeted organizations had implemented zero trust:

    But what is zero trust and why is it something that can benefit organizations and businesses across all sectors (not just the DoD)?

    Let’s hash it out.

    Zero trust is an organization’s answer to the childhood warning “stranger danger!” It’s both a framework and strategy that operates with the understanding that no one — not you, your devices, your apps, or even your CEO — can (or should) be trusted automatically. And it’s nothing personal — it’s not because your IT admin doesn’t like you. This real-time security strategy approaches cyber security from the perspective that everyone inside and outside your network is a potential threat.

    Zero trust touches everything relating to your IT ecosystem and everything that goes on in the background. It promotes the idea that there are no traditional network boundaries; your assets and resources can be anywhere — on prem, in the cloud, or a mix of both. This makes it a versatile approach to hardening your cyber defenses. Therefore, everyone with access to your organization’s network or IT resources must have their identities continuously vetted throughout their connections.

    Regardless of where your assets are that you want to secure, there are three guiding principles at the heart of zero trust security:

    1. Never Trust, Always Verify

    What we mean by this is that users need to authenticate in a verifiable name. Simply taking them at their word just won’t cut it. This entails using setting default-deny policies, setting least access privileges, and using public key infrastructure (PKI) based tools (such as client authentication certificates).

    Whenever someone logs in or tries to access something in a zero trust environment, they’ll need to continually authenticate (prove their identity) throughout the session. Why? Because session IDs can be hijacked and someone unintended can take over a connection. By implementing comprehensive identity and access management, you’re reducing the potential harm an account compromise could cause.

    Manage Digital Certificates like a Boss

    14 Certificate Management Best Practices to keep your organization running, secure and fully-compliant.

    2. Assume a Hostile Environment or That a Breach Has Occurred

    With zero trust, you assume the worst (someone bad is already in your network) but hope for the best. You’ll want to assume that every network connection and access request is from an attacker. This involves monitoring all users, devices, connections, requests, and configuration changes continuously to ensure that no one is accessing something they shouldn’t.

    3. Verify Explicitly

    Verify that users are accessing things securely. Have security mechanisms in place to ensure they’re doing that. This includes enforcing policies dynamically via the policy engine and policy administrator (PE determines whether access is approved or denied and the PA executes that decision). And, as always, monitor and log all access requests and traffic.

    An overview illustration of the zero trust security approach
    Image caption: This graphic represents a basic overview of the foundational concepts behind zero trust: trust nothing and no one, have security mechanisms in place for identity and device verification, and assume all traffic (both inside and outside the network) is an attack.

    There’s No One-Size-Fits-All Approach to Zero Trust

    There are different approaches to zero trust put out by different organizations and different standards as well. Probably the most commonly known zero trust framework is the National Institute of Standards and Technology’s (NIST) special publication: NIST SP 800-207 — Zero Trust Architecture. This document laid the groundwork for other frameworks from agencies such as the U.S. Department of Defense and the National Security Agency (NSA).

    These other frameworks have a lot to offer information of information and applications. (The DoD guidelines, in particular, offer more breadth and depth than the NSA’s.) And we’ll touch on key concepts from these resources throughout the article.

    Why Zero Trust Matters: Looking Beyond the Surface to Secure Your Digital Assets

    We live in a time when you can no longer take things at face value. You can’t simply assume that someone is who they claim to be simply because they type in a username and password; all it takes is a small third-party data breach for someone’s password to become known to the dark web. And if that person uses that same password to secure multiple accounts, then attackers can use it to brute force their way into their accounts.

    This is why it’s crucial that we look much deeper and look at other verifiable and contextual information. This approach helps us determine whether someone requesting access to sensitive resources is authentic and has the authorization to access those assets.

    Discussing this topic of zero trust always makes me think of scenes from the Mission: Impossible movie franchise. In several movies, Tom Cruise’s character, Ethan Hunt, wears masks and contact lenses to impersonate key characters. Sure, on the surface, he looks like each of the people he’s pretending to be. He can even use a voice modulator of some kind to sound like each person he’s impersonating. But just because he looks and sounds like that person doesn’t mean Ethan Hunt (Cruise) really is them.

    Now, let’s leave Hollywood behind for a second and imagine if someone who looks and sounds like your boss or CEO walks into your building. You’d likely assume that it’s him or her. That would be pretty hard to fake, right? Heck, if I saw someone walk in who looked and spoke like our CEO, Bill Grueninger, I’d likely assume it’s really him, too. But if I walked up and started tugging on his face to see if it’s a latex mask or is the real deal, I’d likely find myself landing a really uncomfortable meeting with HR.

    In a digital environment where users authenticate remotely, though, you need to have a way to verify their identities are legitimate. It makes you wonder what major cyber security incidents and data breaches may well have been avoided if the targeted organizations adopted zero trust policies and processes…

    A zero-trust environment differs from a traditional security approach in that zero trust means you have continuously prove your trustworthiness, whereas a traditional environment means that once you’re inside the network, you’re automatically assumed to be safe.

    A graphic with two parts: the first illustrates the concept of a traditional network with an implicit trust zone. The second shows a zero trust network with a no trust zone.
    Image caption: A set of illustrations that show the difference between a traditional trust-based network and a zero trust network.

    Unfortunately, the traditional model no longer works in a world of credential phishing and session hijacking. You need more robust security and authentication measures in place.

    If you search online, you’ll notice that different organizations approach zero trust in different ways. For the sake of this article, we’ll talk about the seven pillars of zero trust in terms of how the U.S. Department of Defense framework defines them. The seven zero trust pillars we outline below are overarching categories of focus for implementing zero trust. Each pillar involves monitoring and logging but also entails other specific protections.

    A graphic using a columned building to illustrate zero trust architecture with each column representing a different pillar of zero trust
    Image source: A diagram we created based on the U.S. Department of Defense’s seven zero trust pillars with the addition of CA and PKI-based digital identity.
    1. Users — Controlling access to protected resources by continuously authenticating users using digital identity components (such as client authentication certificates) and verifying users’ access authorizations.
    2. Devices — Use device digital identity (think TPMs, device certificates, etc.) to authenticate access in real time. Devices also must be patched to mitigate vulnerabilities.
    3. Network/Environment — Segmentation, isolation, and policy restrictions are three critical components to control access and manage how data moves on your network. This approach helps to restrict access and prevent lateral movement within the network.
    4. Applications and Workloads — Whether you’re using resources that are on-prem, cloud, or a hybrid approach, the idea here is to secure the application layer.
    5. Data —Secure your data by developing a comprehensive data management strategy and integrating data security measures such as at-rest and in-transit data encryption. This will help protect your data both while it’s on your servers or moving between two endpoints.
    6. Visibility and Analytics — Having full visibility of your IT environment is crucial to keeping it secure. You can’t protect assets you don’t know exist, and you can’t stop attackers when you don’t realize something is wrong. You can gain actionable insights to improve your cyber security by analyzing your network’s traffic and user behaviors in real time to identify threats. Just be sure to consider that some traffic may contain sensitive data, so decide the best approach (such as informing users and obtaining their consent ahead of time).
    7. Automation and Orchestration — Automation is a scalable approach that takes monotonous tasks off your team’s plates, freeing them up to focus on tasks that require critical thought processes. These tools also enable you to quickly sort through all the noise your security tools generate to find valuable data.

    Zero trust as a cyber security approach has gained strong support over the last several years. This is partly because of the use of identity-based authentication and user authorization that’s required. In a nutshell, here’s a quick overview of how access controls and management play together to boost your organization’s cyber security:

    • Access controls are the rules, settings, and tools you use to control access to sensitive data and resources.
    • Access management is the process of setting up and managing who has authorization to access specific resources and systems.

    Of course, neither of these things is foolproof and requires another security layer in the form of authentication. User and device authentication are all about ensuring that only entities (i.e., those whose digital identities have been verified and their authorizations confirmed) can access your secure digital assets.

    Continuous Authentication Is Integral to Zero Trust

    A key element of the zero trust approach is a concept known as continuous authentication. The idea behind continuous authentication is that all network users, including your employees, must not only prove their identities when they first log in but also continuously prove their identities throughout their sessions.

    Why is this necessary? Because session IDs can be set to last for extended periods — anywhere from a few hours to even a few weeks. This means that if a cybercriminal steals an authenticated user’s access tokens (session IDs and cookies), they can pretend to be them and access whatever protected resources their account has the authorization to access.

    While some platforms have mechanisms to prevent authentication from happening, this may not always be the case. And it’s true that you can set timeout limits to take effect after certain periods, but if you don’t bother setting up these security limits, then it’s inevitable that at least one bad guy might slip through the cracks.

    Continuous Authentication Requires Verifiable Digital Identity

    For zero trust security to work, you need to have a way to prove that you’re really you and aren’t an imposter who’s trying to fraudulently access sensitive data, systems, and other resources. The way to achieve this level of reliable and verifiable digital identity is through the use of public key infrastructure (PKI) and digital certificates. (We’ve talked a lot about these concepts before, but we’ll talk more about them again a little later in the article.)

    Digital certificates are small data files that pack massive punches. They contain verified identifying information about you and/or your organization that a trusted authority (certificate authority) attests is authentic.

    You can think of digital certificates in much the same way as an official passport: that little government-issued booklet contains verified information about you that proves your identity to people you’ve never met. This way, you can show your passport to airport security and other authorities (i.e., people who don’t know you) to prove you’re really you. (Sorry, there were a lot of “yous” in that paragraph.)

    What do digital certificates and continuous authentication have to do with one another? Everything, really.

    • In a zero-trust environment, there are no implicitly or explicitly trusted users, devices, or zones within your network or IT environment. The digital identities of everything and everyone must be authenticated continuously using verifiable methods — period. And digital certificates are a means of doing precisely that.
    • Digital certificates enable trusted third parties to attest to your digital identity’s authenticity. It’s kind of the digital equivalent of how the U.S. Department of State attests to an American’s identity each time it issues a passport.

    Public Key Infrastructure and Zero Trust = The Perfect Combination

    In a zero-trust environment, each employee, device, or other network user must have a way to mutually authenticate in a way that’s verifiable. How? By using a security mechanism that the security of the internet itself is built upon: public key infrastructure (PKI).

    Public key infrastructure is the combination of rules, processes and technologies that enable two parties to communicate securely. Without PKI, if you were trying to connect to your bank’s website, it would be risky: you wouldn’t have a way to securely send your data because you wouldn’t know for sure who was on the other end of the connection. Even if the connection is encrypted, if you’re connecting to a cybercriminal, they’d have the decryption key to unscramble your data and read it.

    Remember the DoD Zero Trust initiative that we mentioned earlier? Its DoD Zero Trust Architecture document shares one of the most beautiful lines we could hope to read in a government resource as an explanation: “The use of mutual authentication of users with PKI-based client authentication or mutual authentication certificates to web applications has long been the effective standard.”

    Darned right, it is. And that’s because PKI isn’t the new kid on the block; it’s been around the block many times since its inception in the mid-1980s. PKI has served as the trusted foundation of internet security since that time because it’s what enables secure remote communications and data transmissions that, otherwise, would be impossible.

    When it comes to remote user authentication and access, looking beneath the surface is a necessity. You can’t simply see that someone logs in using a basic username-password combination and assume it’s the legitimate account owner; you need an additional layer of verification that continually proves it’s the authentic user. Adopting a zero-trust approach can help in several ways:

    Prevents Compromised Credentials and Access Tokens From Being Exploited

    Implementing zero trust is a way to prevent cybercriminals from taking advantage of vulnerable access tokens (session cookies, IDs, or weak credentials) to gain access to sensitive resources while pretending to be legitimate network users. Yup, that’s right — if even one of your employees who has privileged access uses a weak password for their account, it could be game over for your business. All it takes is one bad enough “oops” to cause you to face immense penalties, lawsuits, or even have to close your doors forever.

    Protects Your Brand and Nurtures Customers’ Trust

    Incorporating zero trust into your cybersecurity strategy is also a great way to help protect your organization’s reputation, brand, and bottom line. Okta’s 2021 State of Digital Trust report shows that 75% of American consumers say they likely won’t do business with brands they don’t trust (i.e., after a data breach or misuse of data). Almost half, a whopping 47%, say they’d take things a step further and would permanently stop using a company’s services for the same reasons.

    Imagine what would happen if an unauthorized user gained access to your most sensitive data. This could be your intellectual property (IP), customers’ financial data, or even employees’ records. Regardless of which type of data they get their slimy paws on, exposing sensitive data would spell disaster for your organization.

    Helps Mitigate Other Issues

    In addition to the no-brainer reason of you don’t want your information accessed by unauthorized individuals, there are also other concerns that adopting zero trust could help you avoid

    • Non-compliance issues with regard to industry standards,
    • Data breaches that can lead to hefty fines, penalties, and lawsuits,
    • Your reputation taking a big hit, and
    • Customers not trusting you or your services.

    We’ve seen this type of scenario happen time and again in various data breaches. Here’s a quick example of what could happen without a continuous authentication mechanism in place:

    1. An attacker phishes one of your company’s key employees, tricking or manipulating them into coughing up their privileged access credentials or session ID. This may not be hard considering that IBM’s X-Force Threat Intelligence reports phishing as the attack vector in two in five incidents their team responded to.
    2. The attacker uses their login info or session ID to access secure resources using that employee’s account. Once in, they’re able to move laterally across the company’s network — accessing applications, databases, and other resources that the employee’s compromised account has access to — pillaging as they go.
    3. Once they find interesting and valuable data, the attacker exfiltrates whatever data they can to an external server they control before installing malware onto your systems. It’s a devastating one-two punch you never saw coming that can bring your company to its knees.
    This illustration provides an example of what can happen without adopting a zero trust approach. An employee's session ID or login credentials could be stolen and used by an attacker to fraudulently access the employee's session to steal your organization's data or install malware
    Image caption: A diagram that illustrates the basic concept of how an attacker can exploit compromised credentials in a non-zero trust environment.

    Because your organization didn’t require continuous authentication (i.e., didn’t implement zero trust) or have restricted policies in place that are enforced, your IT security admin or cyber security team doesn’t realize that anything is amiss until it’s too late. Now, you’re not only dealing with a data breach, you’re also scrambling to deal with the ransomware situation as well.

    But wouldn’t a firewall be able to tip off your cyber defenders that something’s wrong? Sure, event logs will show a significant increase in traffic. But since the traffic appears to be legitimate (because the attacker is using the employee’s legitimate credentials, may be using a proxy IP address to disguise their true location, and you’re not analyzing device identity attributes or behaviors), they may not initially realize that it’s actually an external attacker and not your legitimate employee accessing your systems until the damage has already been done.

    Oh boy. We hope you have business continuity, disaster response and disaster recovery plans in place, and that those plans are not only current but that your employees know what their roles and responsibilities are! Cyber resilience is crucial; but without the right security mechanisms, strategies and plans in place, you may not like the outcome.

    Insider Threats in Action: A Real-World Look at the Elliott Greenleaf Breach (2021)

    Attackers are becoming increasingly sophisticated and potential attack surfaces are expanding. As such, our defense of these systems must become more robust and dynamic. To go beyond discussing zero trust from a largely conceptual standpoint, let’s dive deeper and explore the damage caused to a real-world organization by bad actors within its trusted internal network.

    What Happened

    In January 2021, the Pennsylvania law firm Elliott Greenleaf was the victim of an insider attack and sustained catastrophic financial losses, according to WestLaw.com. According to multiple reports, four attorneys and a paralegal secretly downloaded a slew of invaluable sensitive data, including confidential files, trade secrets, and client lists. Their actions as insider threats resulted in irreparable damages to their former employer, which has since filed a lawsuit against the four attorneys and the paralegal.

    The National Institute of Standards and Technology (NIST) defines insider threats as:

    “The threat that an insider will use her/his authorized access, wittingly or unwittingly, to do harm to the security of organizational operations and assets, individuals, other organizations, and the Nation. This threat can include damage through espionage, terrorism, unauthorized disclosure of national security information, or through the loss or degradation of organizational resources or capabilities.”

    As it turns out, these legal professionals, who were trusted to operate internal systems (seemingly with little to no oversight), were wolves in sheep’s clothing. They were joining a rival law firm in Delaware (Armstrong Teasdale) and, it appears, wanted to take Elliott Greenleaf’s info with them.

    Unfortunately, this isn’t an uncommon scenario; Code42’s research shows that there’s a one in three chance an organization will lose intellectual property when one of its employees quits.

    How It Happened

    Let’s quickly break down what occurred that enabled these insiders to wreak havoc based on information shared by Digital Guardian and WestLaw:

    • The attorneys had immense access to files and data. The attackers had access to read, steal, and destroy highly sensitive information. For example, they reportedly shredded 288 lbs of physical documents. (That’s approximately 28,800 pieces of paper if you’re using standard copy paper). In some cases, they enlisted the help of the paralegal to get certain data for them.
    • They accessed systems that appear to lack monitoring and/or alerts. To steal data, they were able to use one or more personal USB devices and had cloud-based file-sharing apps installed on their company devices.
    • They were able to send and delete emails containing sensitive information without detection. As such, they could send additional sensitive information to personal email accounts — and subsequently “double-delete” the messages in an attempt to cover their trails. Granted, the company says it’s able to access the delete emails via their data backup systems, but by that time, the damage had already been done.

    The Big Takeaway From the Elliott Greenleaf Law Firm Situation

    Unfortunately, the Elliott Greenleaf law firmed learned a valuable lesson the hard way: This catastrophe likely could have been prevented (or identifier earlier) if Elliott Greenleaf had adopted a zero trust approach. With zero trust:

    • the employees’ access should have been continuously verified across all systems,
    • their reach (i.e., their permissions and breadth of access) should have been restricted to only what they needed to do their jobs (think policy of least privilege), and
    • their access to resources and use of USB devices should have been disabled — or, at the very least, monitored, logged, and analyzed.

    It’s our hope that you that you keep this story in mind and recognize that the threat from within your organization can be as, if not more, dangerous than outside attackers. Although the damage caused by this insider breach is irreversible, future attacks of this nature can be prevented through by adopting a zero trust posture.

    Now, we’re not going to get into the nitty-gritty of how to actually implement zero trust. There’s far too much information that would need to be covered that it would, basically, entail creating a whole other article. However, NIST (SP 800-207) and the DoD (DoD Zero Trust Reference Architecture) provide some guidance for federal agencies on how to build zero trust architectures (from the ground up or migrate their systems to zero trust over time). Some of this information may be useful to your organization as well.

    Adopting a Zero Trust Strategy Is One of the Best Ways to Secure Your Organization

    Zero trust isn’t totally new, and it certainly isn’t going anywhere anytime soon. It’s gaining traction over time. Okta reports that 55% of surveyed organizations globally indicate that they have a zero trust initiative in place. A whopping 85% of global 2000 (G2000) companies said they’d allocated “moderate” or “significant” year-over-year increases in budgets to fund these initiatives.

    Of course, there is still room for improvement. Research from Forrester and Illumio shows that only 6% of organizations indicate that they have fully deployed zero trust within their IT environments. But, hey, it’s a start, right?

    One of the key attributes of zero trust is limiting who has access to what. This involves setting and enforcing policies, using verifiable digital identity, following the least privilege principle, monitoring all access attempts and behaviors, etc. By limiting a user’s reach to only the resources and systems they need to do their jobs, you reduce your attack surface. So, rather than having cybercriminals have access to everything, they can only access the systems and data that the user is authorized to access.

    In a zero-trust environment, a bad guy will first have to go through a series of verification checks to ensure they’re the authentic user. If they fail that, then they won’t get access to anything. If they succeed, then at least their reach will be restricted to the privileges you’ve assigned the compromised user’s profile. And since you’re keeping an eye on everything and are logging everything for analysis, it’ll help you better mitigate these issues in the future.

     

    Article published on TheSSLStore by Casey Crane

  • What Is Encryption? A 5-Minute Overview of Everything Encryption

     

    Encryption is everywhere online; it’s the process and technologies that enable you to securely log into your email and make online purchases

    What types of information are you sending in emails or via website connections? What are you storing on your company servers? Inquiring minds want to know — namely, cybercriminals.

    Data from Orca Security shows that more than one-third (36%) of organizations don’t bother encrypting the sensitive data they store in the cloud. This includes data such as intellectual property to customers or employees’ personally identifiable information (PII).

    We’ve seen multiple instances of security issues this year involving unencrypted data:

    One way to fight back against cybercriminals is to use encryption to secure your data. But what is encryption? I mean, what does encryption mean, both in the sense of what it does and how it secures your data and communications?

    Let’s hash it out.

    What Does Encryption Mean? A Quick Data Encryption Definition & Meaning

    Encryption is the process of taking plaintext data and transforming it into something random and unreadable. Why? It’s a way to secretly share information by restricting access to it. This way, only your intended recipient (i.e., whoever you want to read the message) can access it and no one else can.

    Encryption involves using two specific types of cryptographic tools:

    • Encryption algorithms (which need to meet specific cryptographic security standards)
    • Encryption key (which needs to be securely generated)
    Image caption: A basic illustration showcasing the process of data encryption.

    Looks simple enough, right? Appearances can be deceiving. The way cryptographic processes work in the background is a lot more complicated than how it appears on the surface. When you encrypt a message on the internet, you’re using a special string of randomized data called a cryptographic key. Keys can either be a set of two unique keys (asymmetric keys), or a single key (symmetric key) that encrypts and decrypts data. We’ll speak more on asymmetric and symmetric key encryption a little later.

    When applied, the key disguises your message by turning it into gibberish. This ensures that only the person who holds a corresponding secret key (i.e., your intended recipient) can read the message through a process known as decryption.

    The following illustration shows a basic overview of what the process looks like when sending a secure, encrypted message:

    A basic illustration of what it looks like when a cybercriminal tries to intercept data in an encrypted communication channel.
    Image caption: A basic illustration of how encryption protects sensitive data from unintended eyes.

    So, how do you know if a website is using a secure connection? It’s got a little padlock icon or another security indicator displaying in the browser’s URL bar:

    1671092879 367 What Is Encryption A 5 Minute Overview of Everything Encryption

    We’ll delve more into that in just another minute or two. But first, there’s one important thing we want to touch on before moving on to talking about what encryption does…

    Secure ≠ Safe

    When people see the padlock icon in their browser, they typically assume it means the website they’re using is safe. That’s not necessarily true. You can still have a website that uses a secure connection but it’s not safe because the site is controlled by one or more cybercriminals. This is why we always tell people that a secure website isn’t necessarily a safe website.

    The way to help customers ensure that they’re connecting to your legitimate website is to add digital identity to the equation. Your digital identity is like your passport; it’s a verifiable way for people who don’t know you to feel confident doing business with you. This is because you have a trusted third party (a certificate authority) vouching that you’re authentic — that you really are (insert your company’s name here).

    You can add digital identity by installing a website security certificate, or what’s otherwise known as an SSL/TLS certificate, on your server. This will enable data to transmit using the secure HTTPS (hypertext transport protocol secure) protocol instead of the insecure HTTP.

    Here’s a quick example of what an extended validation (EV) SSL/TLS certificate looks like in Google Chrome:

    A combined set of screenshots of Wells Fargo's SSL/TLS certificate we captured from wellsfargo.com. The SSL/TLS certificate shows the validation organizational information of Wells Fargo in its details.
    Image caption: A combination screenshot of the SSL/TLS certificate for wellsfargo.com. As you can see, the certificate displays the company’s (subject) verified organizational information, including its location.

    SSL/TLS certificates come in three validation levels: domain validation (DV), organization validation (OV), and extended validation. They rank from lowest to highest in terms of the digital identity assurance they offer (hence why EV certificates are sometimes called high assurance certificates).

    Why You Need to Secure Your Data

    There are several reasons why your organization needs to secure your data and communication channels:

    • You’re required to do so for compliance. Depending on your industry or geographic region, it’s likely that there’s at least one data security regulation or law in place that requires you to secure your data using encryption.
    • You want to protect your reputation. The importance of your brand and reputation can’t be overstated. Not encrypting your data is a surefire way to get yourself some unwanted publicity. If you don’t secure your data, it’s likely just a matter of time before it falls into cybercriminals’ hands.
    • Customer trust matters to you. Encrypting your data goes a long way in helping you develop relationships with customers. If they know that you do all you can to keep their data safe, they’ll be more likely to want to do business with you. If you don’t and let it be known that you’ve had a cybersecurity incident, nearly one-third say they won’t do business with you.
    • Fines, penalties, and lawsuits don’t appeal to you. Don’t spend money on fines, penalties, and lawyers if you don’t have to. You can avoid many situations where you’d face these things by securing your sensitive data.  
    • It’s the right thing to do. There’s something to be said for just doing the right thing because it’s the right thing to do. Protecting the data that people and other organizations have entrusted you to protect definitely fits into that category.

    Encryption Secures Your Sensitive Transmitting and/or Resting Data

    Encryption can be used to encrypt everything from data sitting in your databases to the data that streams from the IoT devices on your network. Without encryption, every day would be open season on your most sensitive data. This is why organizations should use encryption to protect sensitive data at all times.

    Protecting Data in Transit from Man-in-the-Middle Attackers

    Data in transit encryption can be used to secure your data while it’s moving between endpoints. A great example of in-transit data encryption can be seen when your customers’ browsers send information to your web server. This is known as in-transit data encryption, which protects you from interception attacks (i.e., man-in-the-middle attacks).

    Good examples of this are secure SSL/TLS website connections. If you don’t secure your website using an SSL/TLS certificate, cybercriminals could simply wait for your customers to log in to your website and steal their credentials. They do this by intercepting the data, placing themselves in the middle of your connection so all data flows between the customer and the server through them.

    Not only does this spell bad news for your customers, but it’ll be bad news for you since they’ll no longer trust you to protect their data.

    Keeping Your At-Rest Data Safe On Your Servers

    If your data is sitting on your server, that automatically means it’s safe from attackers, right? Not necessarily. Data at rest encryption plays an important role in keeping the data sitting in your databases, inboxes, and other important repositories secure. For example, if someone hacks your email server, any unencrypted messages are at risk of compromise.

    Encrypted Data Is Meant to Be Decrypted…

    Yes, you read that correctly: Encryption is known as a two-way function because encrypted data is meant to be decrypted by someone who has the appropriate key. When you encrypt something, you need to use a key to decrypt that data. In asymmetric encryption, you have two separate keys and each key performs a separate function (one encrypts, one decrypts). In symmetric encryption, it’s a single key that performs both functions.

    It’s important to note that encryption algorithms differ from hash ciphers. While encryption ciphers are meant to be reversed, hash algorithms are designed to serve as one-way functions. Their resulting strings of data are not intended to be reverse-engineered [and, frankly, it’s too impractical to try to do so]). And instead of being used to encrypt data, they’re used as data integrity mechanisms to prove that data hasn’t been altered since it was digitally signed.

    Encryption is a way for two parties to communicate securely. Historically, this meant two parties would have to meet face to face to securely exchange keys. They’d use the same key to encrypt and decrypt information. This is an example of a type of encryption known as symmetric encryption. Also known as private key cryptography, this approach entails using a single key to scramble and unscramble your messages.

    Here’s a basic look at how encryption and decryption work using symmetric (matching) keys:

    What is encryption graphic: A basic example of encryption and decryption
    Image caption: A screenshot of a symmetric encryption algorithm that shows how both parties have a copy of the same key they can use to encrypt and decrypt messages.

    Of course, the encryption ciphers we use to communicate over the internet are far more complex than the simple example we’ve provided above. However, the graphic gives you the basic idea of the concepts of encryption and decryption.

    Symmetric Encryption Has Been the Go-To Method Throughout History

    Symmetric encryption is nothing new; it’s been around for thousands of years, dating back to at least ancient Egypt. It’s the old, trusted war horse of cryptography and it’s had many reinventions over its lifetime.

    When I was a kid, I had out-of-state cousins who would come to visit my family. My cousins and I would exchange handwritten letters, and one of my cousins used to write brief messages in ciphertext. It was a basic shift cipher (AKA a Caesar cipher), meaning that you just shift a letter by one or more characters in the alphabet. The number of movements is determined by a secret key that only we would know. (This way, her siblings and mine couldn’t read our messages.)

    For example, if we used a key of 6, then “a” would become “g” and so on. So, if the cousin wrote the word “beach” and used a key of 6, then it would become “hkgin.” Because we both had knowledge of the key, this is a basic example of how it looks when you use symmetric encryption.

    Traditional (Symmetric) Encryption Can’t Stand on Its Own in an Internet World

    We live in a time when the internet has become integral to businesses. This invention is a double-edged sword; it’s great because companies can engage in remote, near-instantaneous communications. But that also means that no one wants to hop on a plane and fly halfway around the world every time they need to do a transaction.

    But why would you need to do this? Because the internet is inherently insecure. It’s an open public network that sends plaintext data, meaning that your sensitive information can be intercepted by bad guys who can use it to carry out all kinds of evil (data theft, identity theft, fraudulent transactions — the list goes on). This is why industry experts had to come up with a way for people to communicate securely without having to first meet up to exchange symmetric encryption keys.

    Why Asymmetric Encryption Is Essential to Secure Online Communications

    In a nutshell, asymmetric encryption (i.e., public key encryption) enables people to communicate remotely without having to meet up in person. This type of encryption uses a pair of unique (but mathematically related) keys to carry out the encryption and decryption processes.

    People call it by different names, but this type of encryption boils down to the following breakdown:

    • The sending party encrypts the message using their public key.
    • The receiving party decrypts the message using the corresponding (separate) secret key.

    What this does is enable you to communicate data in open channels (public and insecure networks), such as on the Internet. Here’s a look at how this process works from a little more technical perspective:

    An illustration of how the encryption and decryption process works in asymmetric encryption
    Image caption: A screenshot of how it looks when you transmit encrypted data to a website using asymmetric encryption.

    Think of the last time you made an online purchase. When establishing the website connection, your browser reached out to the website’s server. The two parties exchanged some key information (literally and figuratively speaking) that they used to exchange a session key. This key is what they then used the rest of the session to communicate because it required fewer resources than an asymmetric connection.

    Asymmetric vs Symmetric Encryption: Is One Better Than the Other?

    It’s not so much a question of which one is better; asymmetric and symmetric encryption both play important roles in securing online data and communications. Quite frankly, you need both to achieve secure website connections:

    • You use asymmetric encryption to securely exchange key-related information
    • You use that shared key information to create a secure symmetric session that can be used to communicate the rest of the session

    You use asymmetric first because it’s a secure way to share your symmetric keys on the (insecure) internet. But asymmetric algorithms require a lot of resources, meaning they’re not great at scale (i.e., enterprises handling massive traffic). So, the smarter idea would be to use asymmetric algorithms at the beginning and then switch to symmetric algorithms that are less taxing at scale.

    The More Important Considerations Are Key Security and Certificate Management

    The encryption algorithms you use are only as good as the security you use to protect your cryptographic keys. If even one of your cryptographic keys gets exposed, then you’re in for a world of hurt because it means that every bit of data that key encrypted is now at risk of compromise. For example, this could be the case if you didn’t use algorithms that enabled perfect forward secrecy.

    Furthermore, you also need to carefully track and manage all of the certificates in your environment. If even one certificate expires and is still used on your website, for example, then it means:

    • Users see ugly “not secure” warning messages on your website
    • All data that transmits to your website is insecure

    Final Thoughts on What Encryption Means

    As you can see, answering the question “what is encryption?” in the simplest terms isn’t always easy, but we gave it our best shot. (It’s easy to overthink things.) Hopefully, you’ve found this article both informative and useful as you go about your day. The big takeaways we want you to leave with include the following:

    • Encryption is a common cryptographic process for disguising or concealing data
    • Encryption secures your data both in transit (think SSL/TLS) and at rest (think of emails on your server)
    • It can be done using unique keys (symmetric encryption) or identical key pairs (symmetric encryption)
    • For encryption to work, you must carefully manage your certificates and keys

     

    Article published on TheSSLStore by Casey Crane

  • HTTP vs HTTPS: What’s the Difference Between the HTTP and HTTPS Protocols?

     

    The difference between HTTP and HTTPS can be the difference between your business being successful or suffering a data breach. Let’s quickly highlight the key differences you should know about these two foundational connection types

    HTTP, or hypertext transfer protocol, is the default connection type that websites revert to without a special security tool called an SSL/TLS certificate. See that padlock near the top of your browser window? That means you’re using HTTPS, which is a secure connection (hence, the “S” at the end). If you don’t see one, it means you’re using an insecure (unprotected) connection that leaves your data vulnerable. (In a nutshell, that’s the difference between HTTP vs HTTPS.)

    Unless you like handing out your most sensitive data like it’s Halloween candy, you’ll want to ensure you’re using HTTPS for all of your website connections.

    But aside from adding an extra letter at the end of the acronym, what is the difference between HTTP and HTTPS? Don’t worry, we’ll cover everything you need to know in just a few moments.

    Let’s hash it out.

    A 2-Minute Overview of HTTP vs HTTPS and Their Differences

    HTTP and HTTPS are both internet connection protocols — meaning they’re sets of rules that govern how you transmit data remotely between parties. (For example, between your website and the customers who connect to it.)

    The difference between the two boils down to data security: One secures data in transit (HTTPS) using verified identity and public key cryptography while the other does not (HTTP). This means that while data is transmitting via HTTP, it’s vulnerable to interception attacks (i.e., man-in-the-middle attacks). HTTPS is basically HTTP with a little something “extra.”

    HTTPS = HTTP + Transport Layer Security (TLS)

    TLS is the successor of SSL, which you’ve likely heard of, and requires a site owner to install a special digital certificate called an SSL/TLS certificate (AKA a website security certificate). TLS combines verified digital identity and encryption with the traditional HTTP request and response messages to make them more secure. This way, any unintended users can’t intercept and read those messages in transit.

    We won’t get into all of the technical nitty-gritty of how HTTPS works here — there’s not enough time for that in this article. Instead, take a look at the following illustration to see the difference between HTTP and HTTPS when it comes to securing website connections:

    Image caption: A set of diagrams that display the difference between HTTP and HTTPS to secure data in transit.

    Here’s a quick-glance guide that highlights the differences of HTTP vs HTTPS:

    Type of Protocol HTTP HTTPS
    What It Is (Technical Definition) Hypertext transport protocol — this is a set of rules for transmitting data in plaintext. Hypertext transport protocol secure — this set of rules teams encryption with verified digital identity to encrypt data in transit. This means your data is secure against unauthorized access.
    Simplified Definition An HTTP connection is like sending a postcard that’s open for everyone to see and is susceptible to unauthorized modifications. An HTTPS connection is like sending a coded (enciphered) message that only you have the key for, and that’s sealed in a envelope with a wax stamp to protect the integrity of the message.
    Requests and Responses Request and response data for your website is not encrypted. Uses transport layer security (TLS), formerly secure sockets layer (SSL), to encrypt data to secure data in transit.
    Port Number(s) Port 80 Port 443
    How to Enable It Doesn’t require anything special; this is the default communication protocol for data transfers. This is what servers revert to when secure connections fail, or website security certificates aren’t installed on the server. Requires installing an SSL/TLS certificate on your server that contains verified info about your domain and organization.
    How You Know It’s Enabled Security icons display in your browser’s address bar to indicate your website connection isn’t secure (icons vary by browser): A padlock icon with a line marked through An exclamation markA padlock with an exclamation mark and “HTTPS” crossed out with strikethrough text   You’ll also see “http://” at the beginning of the website’s URL. (This may require you to click on the URL to get it to display.) A locked padlock icon that communicates that the website (or, more accurately, its connection) is secure.   You’ll see “https://” display in the web address bar as well. (This may require you to click on the URL first to get it to appear.)
    Security Risks Vulnerable to man-in-the-middle (MitM) attacks that enable cybercriminals to intercept your communications and steal, manipulate or delete your data in transit. The recommended security mechanism to protect your data in transit against MitM attacks and other related security issues.
    Performance Speeds HTTP is faster than HTTPS, but the difference is negligible and doesn’t outweigh the security benefits of the latter. HTTPS is slower but more secure than HTTP. However, HTTP/2, which compresses data and supports multiplexing, is faster and requires the use of HTTPS.

    Why You Should Use HTTPS Instead of HTTP

    When users visit websites loading via HTTP, they’ll see “Not Secure” messages that caution proceeding any further. As you can imagine, these warnings can have negative effects on your reputation and relationship with customers. After all, why should they trust you when you’re making no visible effort to keep their data secure? They shouldn’t, and rightfully so. This is why you need to step up and do something about it to make your website more secure.

    Before the internet, you physically had to meet up with someone to securely exchange data. (Think of clandestine meetups in classic spy movies). Otherwise, you’d risk a message being intercepted where someone could make unauthorized changes to its contents, and you’d never know the difference.

    In an age of near-instantaneous communications, these time-consuming and expensive rendezvous are no longer necessary. Public key encryption, which is at the core of what makes HTTPS possible, enables people the world over to engage in secure remote communications.

    Enabling HTTPS on your website is a smart move for several key reasons:

    • Resolves the security issues plaguing HTTP requests and responses
    • Requires the verification of your site’s digital identity
    • Gets rid of the ugly “Not Sure” and “Insecure Website” warnings that drive away customers

    How HTTP & HTTPS Sites Display in Your Browser (Chrome, Firefox, and Microsoft Edge)

    Look at the web address bar in the Google Chrome browser: Is there a locked padlock icon displaying? How about an “https://” displaying in the URL itself when you click on it? If you answer yes to either (or both) of these questions, great! This means you’re using a secure, encrypted connection.

    A screenshot of Hashed Out, which loads using a secure HTTPS connection


    Image caption: A screenshot example of a secure website that’s using an HTTPS connection. This is demonstrated through the inclusion of the security padlock icon to the left of the website URL.

    If your answer is no because you’re not seeing a locked padlock in Chrome but are seeing an exclamation point (or a padlock with an exclamation point), it means the website is using HTTP and isn’t secure:

    A screenshot of an example web page that's loading via the insecure HTTP protocol
    Image caption: A screenshot of an insecure (HTTP) website as it displays in Google Chrome. This exclamation point is meant to catch the user’s attention and warn them that the website is insecure.
    A screenshot of BadSSL.com loading an example that shows an expired SSL/TLS certificate error with a
    Image caption: A look at how Google Chrome displays HTTP error messages (in this case, how an expired SSL/TLS certificate displays).

    Unsurprisingly, browsers like to put their own spins on things. Mozilla’s Firefox browser takes a slightly different approach, displaying the padlock with a red line through it in the address bar:

    A screenshot of a real-world example that shows an HTTP (insecure) site loading in the Firefox browser
    Image caption: A screenshot of a website that’s loaded via an insecure (HTTP) connection on Firefox. The same concept applies here as with Chrome — only this time, it uses a red slash to indicate the website’s insecurity.

    Similar to Google Chrome, Microsoft’s Edge browser also wants it to be obvious that you’re using an insecure website. They use virtually the same UI with a combination of colored exclamation points and strikethrough text to catch your attention — they just don’t use as much red as Chrome for SSL/TLS related error messages. For example, check out this screenshot from an example insecure website:

    HTTP vs HTTPS graphic example: An insecure website loading in Microsoft Edge.
    Image caption: A screenshot of a website loaded via an insecure (HTTP) connection in the Microsoft Edge browser. This is like the love child of Chrome and Firefox’s warning indicators: It has the exclamation and “Not Secure” message like Chrome but the red coloration like the slash mark in Firefox.

     

    Final Thoughts on HTTP vs HTTPS Differences

    It’s easy to see why enabling HTTPS on your website is a no-brainer. While HTTP is technically faster in terms of performance, that gets blown out of the water when you consider the security advantages that its more secure counterpart offers. HTTPS pairs verified digital identity with encryption to ensure that only the right party is able to access your secure data. HTTPS clearly wins the “HTTP vs HTTPS” battle.

    In the overwhelming majority of situations, there’s no excuse for using an insecure HTTP connection for your website. The few-and-far-between exceptions would be websites where no sensitive information is requested or shared by site users (i.e., informational websites, but even then there may be an admin login URL). If your organization has an ecommerce store, lets users log in, or otherwise collects sensitive data, then you’d better secure your website ASAP with HTTPS.

    Any delay further leaves your (and your customers’) data open to theft, modification, and other issues.

     

  • 5 Examples of When to Use a Digital Signature Certificate

     

    Whether you’re a software creator or sales manager, digital signatures are essential to the security and authenticity of your data. Here are several of the ways that you can use digital signature certificates to enhance trust in your organization

    We live in a world where you really have to question everything: is this email from your boss legitimate? Is the software update you want to install authentic, or is it a trojan that’s waiting to infect your device? When you log in to your favorite eCommerce website, how do you know it’s legitimate?

    A digital signature certificate could hold the answer in all of these cases. These tiny data files help your web or email client verify that the file or other party you’re connecting to is trustworthy and authentic. This way, you don’t inadvertently share your sensitive login information or other data with cybercriminals.

    But how can you use digital signature certificates to your advantage? We’ll go over all of that in just a few moments. But first, we think it would benefit our newer readers to briefly recap what a digital signature is and why you need a digital signature certificate to create it.

    Note: If you’re already well acquainted with digital signatures and digital signature certificates, jump ahead to our list of digital signature certificate use cases.

    What Is a Digital Signature? A Quick Recap

    Digital signatures, also called public key signatures, are a cryptographic method of showing who created a digital asset and ensuring the item hasn’t been changed by another party. Examples of such assets include emails, PDFs, Word files, software application codes, etc. Applications frequently use visual marks of some kind (e.g., a ribbon mark in Microsoft Outlook) to represent digital signatures.

    These signatures are trusted because you need to have a special file called a digital signature certificate in order to sign them digitally. But before you can get this digital certificate, a publicly trusted third party (called a certificate authority or CA) has to carefully vet your identity. Once you receive and start using your digital signature certificate, it proves that whatever you sign is authentic because it was created and signed by you, and your identity has been validated.

    Digital signatures are a type of electronic signature. But unlike regular electronic signatures, which generally look similar to handwritten signatures, digital signatures might not look anything like traditional signatures. Here are a few quick examples to showcase the difference between electronic and digital signatures:

    Image caption: A visual comparison that shows the difference between some of the visual indicators that may display for an electronic signature (left) and a digital signature (right).

    How Digital Signatures Are Created

    To create a digital signature, you first need to have a digital certificate in hand. A digital certificate is a small data file that contains verified, identifying information about you or your organization. (This is the main info that displays to users.) But that’s not all that’s required. Without getting too technical, digital signatures are created by applying two cryptographic tools to the data you wish to protect:

    • A special cryptographic function (called a hash function or hash algorithm) — This creates a hash value (a mishmash of letters and characters) of a fixed length, which masks the true size of the input and ensures the integrity of the data.
    • A private key, which encrypts the hash value — When the recipient receives or downloads the file, they can decrypt it using the signer’s public key. This key ensures only the intended user can read the data.

    Digital Signatures Enable You to Prove You and Your Files Are Legitimate

    A digital signature validates your identity to other parties and ties it to whatever you’ve created and signed. The important takeaway here is that digital signatures offer two key qualities that you won’t find in regular electronic signatures:

    • Authentication — This means you can prove that you or something you created is legitimate.
    • Non-Repudiation — This ensures recipients that you, and only you, created or signed the item in question; that an imposter didn’t fraudulently make it.

    Historically, if you wanted to prove that you’re the legitimate signer of a document, you’d have to meet up with a public notary to have them observe you signing it. This process required providing the notary with verifiable proof of identity — this is typically some form of ID from a trusted entity (i.e., your driver’s license or ID issued by your state or country’s government).

    This is fine if you’re physically located in the same area where it’s easy to meet up to carry out this process. But what if you’re trying to do business with someone in another country? Meeting up face-to-face then becomes a lot more complicated and costly.

    So, where do you find digital signatures? All over the place, honestly. You’ll find digital signatures used in everything from website connections to document signing.

    You Need a Digital Signature Certificate to Use Your Digital Signature

    Digital signatures are typically stored in special files known as digital certificates. For the sake of this article, we’ll call them digital signature certificates. Digital signature certificates are small digital files that enable you to use those signatures online.

    A few examples of these digital signature certificates include:

    Of course, there’s another type of digital certificate that uses digital signatures: an SSL/TLS certificate. This file is what enables you to prove that your website is legitimate because it’s been signed off on by a trusted CA (like DigiCert or Sectigo). But we’ll talk more about that in a little bit.

    Okay, now that we have all of that out of the way, let’s jump right to what you need to know about how you can use each of these digital signature certificates…

     

    5 Digital Signature Certificate Use Cases For Your Business

    For virtually all of our readers, you’re likely already using digital signature certificates in one way or another (you just might not know it). However, there may be some use cases that you’re not as familiar with or aren’t sure how to implement within your IT environment. We’re here to explore those and more:

    1. You Need a Way to Show Your Microsoft Office and PDF Files Are Authentic

    A screenshot of a Microsoft Word digitally signed document
    Image caption: A screenshot of how the digital signature information displays in a digitally signed Microsoft Word document.

    Nowadays, you practically can’t do anything within your business without using Word, Excel, or PDF files. Of course, you’d like to assume that someone will send you only legitimate files via email. However, the reality isn’t as pretty. While it may be true, say, 90% of the time, the remaining percentage is enough to crack those rose-colored glasses.

    As recent cyber security statistics and cyber crime statistics show, the threat landscape continues to change. New threat actors seemingly arrive on the scene almost daily and attack methods evolve with them. For example, SonicWall reports the prevalence of malicious Microsoft Office files decreased 64% in 2021; malicious PDFs, on the other hand, increased 52%.

    So, how can you show users that your documents and files are legitimate? Digitally sign them first using a document signing certificate. For example, this is what it looks like when you sign a Word document using a document signing certificate:

    Here’s what it looks like when you sign an Adobe PDF file with an applicable digital signature certificate:

    An example digital signature certificate's display for a PDF document
    Image caption: A screenshot of how a digital signature’s information displays in a digitally signed Adobe PDF file.

    2. You Want to Eliminate Warning Messages When Users Download Your Software

    SonicWall’s 2022 Cyber Threat Report data shows that malicious executables represented a whopping 30.27% of the cybersecurity company’s malicious file detections. As such, as a software developer or publisher, you need to have a way to show that:

    • Your software is authentic,
    • It’s actually from you, and
    • No one’s modified it.

    You can do this using a code signing certificate. These certificates are typically offered with two options of validation levels: organizational (i.e., standard) and extended. (Note: Some certificate authorities offer individual validation as well.) When you use this type of digital signature certificate to sign your software, you attach your organization’s verified information to the file regardless of the validation type you choose.

    A side-by-side comparison of an unsigned executable versus a digitally signed executable
    Image caption: A set of screenshots that show the difference between how files display when they’re digitally signed (right) and are not digitally signed (left). A digital signature certificate lets you display your verified publisher name on the installation prompt screen.

    Both types of certificates are trusted automatically by browsers and operating systems. The big difference between the two validation levels is that Windows Defender SmartScreen requires an EV certificate if you don’t want an ugly warning message to pop up:

    A Microsoft Defender SmartScreen warning message
    Image caption: A screenshot of the warning message that Windows Defender SmartScreen displays when you try to install unsigned software.

    3. You Want to Give Customers and Prospects a Reason to Trust Your Website

    Trust is hard to earn yet fragile as glass. Once you earn your customers’ trust, you need to do everything possible to protect it. Having a way to prove that your website — your brand’s digital representation — is legitimate is essential to that mission.

    Every time you visit your favorite website, the server sends your browser a file (i.e., an SSL/TLS certificate) containing crucial identifying data that proves you’re connecting to the right server. This website security certificate is issued and digitally signed by a publicly trusted entity known as a certificate authority (CA). The CA’s trusted root

    A digital signature certificate's chain of trust
    Image caption: A screenshot of the certificate authority’s chain of trust, which showcases the digital signatures of each certificate that signs the next to attest to its authenticity.

    The CA’s digital signature means that this globally trusted entity is vouching for you, saying that you’ve, essentially, been vetted and are trusted. Having such a way to prove your organization’s authenticity is particularly crucial when you consider recent data from Bolster shows that their systems detected nearly 10.7 million phishing and scam pages in 2021 alone. To put this in more relatable terms, it means Bolster’s team detected an average of 29,190 fraudulent pages every day throughout the year.

    Want your authentic website to stand out from the sea of fraudsters’ sites? Then slap your vetted and validated identity on it by installing an SSL/TLS certificate right away. In addition to asserting your digital identity, SSL/TLS certificates enable users to communicate securely with your site. If you install an extended validation (EV) code signing certificate, then you take your digital identity to another level by displaying your verified company information upfront. This way, users don’t have to dig around your certificate info to find the details.

    A screenshot of The SSL Store's home page and SSL/TLS digital signature certificate information displaying
    Image caption: A screenshot of the verified company information for TheSSLstore.com.

    4. You Need to Prove to Recipients That Your Email Communications Are Authentic

    Phishing is one of the top cyber attack methods used by cybercriminals. Verizon’s 2022 Data Breach Investigations Report (DBIR) data shows that email is one of the two leading attack vectors used in known data breaches. Furthermore, their report indicates that 75% of the malware the median organization received in 2021 came via email.

    Sure, you can — and should — train your employees to recognize the threats associated with phishing attacks and social engineering. But it doesn’t hurt to add another more technical layer of security to the equation; this is where digital signature certificates for email come into play.

    These certificates are known as email signing certificates or S/MIME (single/multi-purpose internet mail extension) certificates. They allow you to attach your digital signature to messages so your recipients can confirm they came from you. These certificates offer the added benefit of enabling you to encrypt your emails as well. This helps to provide end-to-end encryption by securing the emails before they leave your email server.

    Here’s a quick look at what a digitally signed email looks like to your recipient:

    A screenshot that shows an email message that was signed by a digital signature certificate
    Image caption: The screenshot above shows both the verified “signed by” information and the ribbon icon that indicate I’d digitally signed and sent the email to one of my colleagues.

    5. You Want to Authenticate Without the Risks Associated with Traditional Passwords

    There’s no such thing as a perfect authentication method; an enterprising cybercriminal will inevitably find a way to authenticate as you (fraudulently) if they’re truly motivated. But the goal is to make yourself as difficult a target as possible; this way, 99% of cybercriminals will give up and move on to the next target. Make yourself one of the hardest-to-reach fruits on the tree instead of one of the easy-to-steal, low-hanging fruits.

    This is where a type of digital signature certificate, known as a client authentication certificate, can come in handy. A client authentication certificate enables you to authenticate without having to type in a username or password. Instead, you have a PKI certificate installed on your device, enabling you to authenticate automatically.

    Why is this necessary? ForgeRock reports that 50% of cyber attacks they studied were due to unauthorized access through various account compromises. Of course, there are many ways accounts can become compromised. One of the most common methods is phishing, which involves an attacker stealing a user’s login information using social engineering tactics.

    Using PKI-based authentication instead of a username-password combination means you no longer have a password that can be phished or stolen via malware. You simply go to the web app or system you have permission to access, and the authentication “magic” happens on the backend automatically. No muss, no fuss.

    A screenshot of a digital signature certificate's information that displays for a client authentication certificate
    Image caption: An example of a client authentication certificate. This type of digital signature certificate enables a user to authenticate automatically without using traditional login credentials.

    Final Takeaways on Digital Signature Certificates

    It’s now more important than ever to secure your organization’s digital identity and data. Choosing to use a digital signature certificate to secure your digital assets is the difference between sending or receiving authenticated communications or files instead of unauthenticated (and potentially dangerous) ones.

    To get a digital signature certificate for your website, emails, documents, or software:

    • Evaluate what you need to secure and authenticate.
    • Go to your favorite CA or authorized reseller’s website.
    • Choose the certificate(s) based on the type(s) of coverage and validation type.
    • Purchase your certificate(s).
    • Generate a certificate signing request (CSR) for domain validation (DV) and organization validation (OV) certificates, if applicable.
    • Provide the CA with the necessary organizational information to complete validation.
    • Collect your digital signature certificate and install it on your server, device, or client.
    • Start using your certificate right away!

     

    Article published on TheSSLStore by Casey Crane

  • SSL Installation on Webmin

    The following instructions will guide you through the SSL installation method on Webmin. If you have got more than one server or device, you may need to install the certificate on every individual server or device you wish to secure. If you still haven’t generated your certificate and completed the validation method, reference our CSR Generation instructions and disregard the steps below.

    Steps required:

    1. Private Key
      • This file should be on your server, or in your possession if you generated your CSR from a free generator tool. On certain platforms, such as Microsoft IIS, the private key is not immediately visible to you but the server is keeping track of it
    2. Server Certificate:
      • This is the certificate you received from the CA for your domain. You may have been sent this via email. If not, you can download it by visiting your Account Dashboard and clicking on your order.
    3. Intermediate Certificates
      • These files allow the devices connecting to your server to identify the issuing CA. There may be more than one of these certificates. If you got your certificate in a ZIP folder, it should also contain the Intermediate certificates, which is sometimes referred to as a CA Bundle. If not, download the appropriate CA Bundle for your certificate.

    Installation Steps:

    Copy Certificates to the Server
    Copy your certificate files (SSL & intermediates), along with your private key, and put them on your server.

    Locate your Miniserv.pem file
    It’s usually located in the same directory as your Miniserv.conf file. You’re going to be replacing miniserv.pem with a new one you will create shortly.

    Create a new Miniserv.pem
    There are two ways to do this, either enter the following command line:
    cat private.keyyourdomain.crt > new-miniserv.pem
    OR, you can open both your SSL certificate and private key, paste both into a new .txt file (key first, then certificate) and save it as new-miniserv.pem.

    Configure your miniserv.conf file
    Finally, you’ll need to add your intermediate. Open your .conf file and enter the location of the intermediate you copied to the server earlier:
    extracas=/etc/webmin/intermediate_certificate.crt

    Hurrah! You’ve successfully installed your SSL certificate! To check your work, visit the website in your browser at https://yourdomain.tld and view the certificate/site information to see if HTTPS/SSL is working properly. Remember, you may need to restart your server for changes to take effect.

    You can check your SSL installation on SSL Checker Tool.

    Good luck! 😀

  • Is Free SSL Right for Me?

    Is Free SSL Right for Me?

    Is Free SSL Right for Me?

    When free SSL certificates came on the scene in 2016, bloggers and business owners alike cheered. And, now that Google is serving up all unencrypted pages with a “Not Secure” warning, they offer a fast, economical option for securing your website.

    Free SSL certificates provide peace of mind that all information that’s shared is encrypted and protected in transit. This is an essential step in your website security. But, depending on the type of site you have and your goals—you may want to consider upgrading to a paid business-validated SSL certificate.

    Here are a few things you’ll want to think through before you decide if free is the way to go.

    • Identity Matters—Free SSL certificates provide encryption and validate you own your domain. This is probably sufficient if you have a blog or small personal non-business site. But, today’s savvy visitors are painfully aware of how often data gets into the wrong hands. Business-validated SSL certificates require more extensive vetting by the Certificate Authorities (CAs), so your visitors feel confident you’re a legitimate business they can trust.
    • The Power of Site Seals—You may be surprised to know that, according to monetizepros.com, a whopping 61% of shoppers decided not to buy because a site was missing a trust seal. Business-validated SSL certificates, specifically Extended Validation (EV), proudly display a dynamic site seal that gives your visitors the reassurance they’re looking for.
    • What If Protection—Sure, “what if” may never happen. But, if you’ve ever filed an insurance claim for your house or car, you know protection for the unexpected when you do need it is worth every penny. If something goes wrong with your certificate, even if it’s not your fault, business-validated SSL certificates include a warranty that protects you against excessive liability.
    • Expert Guidance—Generating CSRs, validating, installing and managing SSL certificates, not to mention compliance, can be confusing, even with free versions. You never know when you’ll need a team of experts to call on for guidance. What if another Heartbleed bug came along? Would you be able to fly solo and know exactly what to do? If you’re like most organizations, the answer is no. Business-validated SSL certificates provide the support and expertise you need, when you need it.

    Choosing the right SSL certificate is an important decision that has daily ramifications on your reputation, engagement, conversion and overall online success. On the web, trust and perception are everything, so it’s important to review your options and make an informed choice that fits your budget and business goals.

  • Why You Need SSL Certificates

    Secure your online success

    SSL certificates perform two major functions—encryption and identity validation. Both are essential to gaining the trust and, ultimately, the business of online visitors.

    You’re probably aware that all major browsers now label all unencrypted webpages with “Not Secure” warnings. If you’re doing business online, the impact of this is huge given that, according to the CA Security Council Report, only 2% would proceed past untrusted connection warnings and only 3% would give credit card information without the padlock icon.

    Since SSL certificates enable encryption, or HTTPS, every one of your webpages needs one to avoid these negative messages and protect data in transit. But, there are many other advantages of ensuring your webpages have SSL certificates.

    Here are eight other important ways SSL certificates benefit you and your visitors:

    Improve website performance—In this “I want it now” world, no one’s going to wait for your webpages to load. HTTPS speeds up page loads to deliver a great visitor experience.

    Drive more website traffic—Google rewards websites that serve every page via an encrypted HTTPS connected with as much as a 5% boost in search engine rankings. That means more people clicking through to your site.

    Reduce shopping cart abandonment—Abandonment rates can soar as high as 75%. Why? One of the top 7 concerns of online shoppers is whether your website is legit. SSL certificates give them the confidence they need to hit “Buy Now’.

    Increase conversions—Bizrate reports 69% of online shoppers look for websites that display trust symbols. It’s easy enough to click away to a competitor who proudly shows them off. A Tec-ED survey reported premium EV SSL certificates have been proven to increase conversions.

    Leverage the latest innovations—HTTP/2 is the first big revision to the outdated HTTP network protocol. It’s faster and safer, but browsers require a secured connection to unlock these advantages.

    Enable must-have mobile features—The most in-demand mobile features, including geo-location, device orientation, full screen, microphone and camera are only enabled over secured HTTPS sessions.

    Sharpen your competitive edge—The level of SSL certificate you choose is a differentiator that motivates visitors to do business with you instead of “the other guys” that don’t have a premium SSL certificate. Trust us, your visitors will notice you’ve taken the extra steps to put their security front and center.

    Avoid phishing attacks—It might be easy for cybercriminals to squeak by domain validation with a DV certificate and fool unsuspecting visitors with “Secure” in the address bar, but the Extended Validation (EV) process is designed to ensure only the “good guys” are approved.

    The Choice is Clear

    Beyond meeting the new encryption standard, SSL certificates improve your speed, innovation and conversions—all important factors for online success. At the very core is trust. Remember, you’re in control of how visitors perceive you online. Review your SSL certificate options to find the one that’s right for you and start earning the trust you deserve.