{"id":2851,"date":"2012-03-20T07:00:45","date_gmt":"2012-03-20T15:00:45","guid":{"rendered":"http:\/\/www.formtek.com\/blog\/?p=2851"},"modified":"2012-03-20T07:00:45","modified_gmt":"2012-03-20T15:00:45","slug":"digital-certificates-compromised-keys-threaten-a-foundation-of-security","status":"publish","type":"post","link":"https:\/\/formtek.com\/blog\/digital-certificates-compromised-keys-threaten-a-foundation-of-security\/","title":{"rendered":"Digital Certificates: Compromised Keys Threaten a Foundation of Security"},"content":{"rendered":"

SSL certificates encrypt and secure data. \u00a0The SSL certificate was designed to bring security to the internet<\/p>\n

A digital certificate<\/a> is an electronic document that uses a digital signature to\u00a0bind a public key to an identify. \u00a0The certificate verifies that the individual or organization is the owner of the public key. \u00a0The information encrypted into the certificate \u00a0typically includes information like the name of the person or organization, address, and unique certificate serial number. \u00a0Digital certificates are used to validate ownership to enable secure data transfer.<\/p>\n

While the process to create and use an SSL certificate isn’t rocket science, it isn’t necessary trivial or hassle-free either. \u00a0Roger Grimes<\/a>, contributor at InfoWorld and Principle Security Architect at Microsoft, reports from a BlackHat conference<\/a> that it’s estimated \u00a0that 90 percent of SSL digital certificates are misconfigured. \u00a0A survey <\/a>conducted by Venafi and Osterman Research found that 54 percent of organixations admit to being lax in their management of SSL certificates. \u00a044 percent of companies manage the lifecycle of their SSL digital certificates with post-it notes and spreadsheets.<\/p>\n

Jeff Hudson<\/a>, CEO of Venafi, said that “Organizations protect mission-critical and often regulated data with hundreds or thousands of encryption keys and digital certificates. \u00a0But as this survey reveals, too many companies have inaccurate or incomplete data about their security assets. The unquantified and unmanaged risks these certificates and keys pose is significant\u2014risks magnified through the increasingly pervasive use in corporate data centers, cloud-based systems and mobile devices.”<\/p>\n

But despite these problems, the real problem with SSL certificates isn’t on the web-site implementation side. \u00a0The problem is with the companies that create and issue SSL certificates. \u00a0Security Breaches at Certificate Authorities (CA) like Verisign, Diginotar <\/a>and Comodo<\/a> have made headline news over the last months. \u00a0Experts expect that other CA’s have also been compromised but have not gone public with the information.<\/p>\n

The biggest and most recent reporting has been with Verisign. \u00a0In February 2011, Verisign admitted that their servers had been hacked in 2010. \u00a0Their October 2011 filing with the SEC<\/a> stated that “In 2010, the Company faced several successful attacks against its corporate network in which access was gained to information on a small portion of our computers and servers.” \u00a0With more than 110 million domains registered with Verisign, a potential breach of their system could result in devastating loss or disruption.<\/p>\n

What’s the alternative to SSL? \u00a0Right now there isn’t really another option.<\/p>\n

Jacob Appelbaum<\/a>, independent security researcher, said<\/a> that “The Certificate Authority system as it stands today is a house of cards and we’re witnessing in public what many have known for years in private. The entire system is soaked in petrol and waiting for a light.”<\/p>\n

\"Digg<\/a><\/div>
\"Reddit<\/a><\/div>
\"Stumble<\/a><\/div>
\"Buzz<\/a><\/div>
\"Vote<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Kick<\/a><\/div>
\"Shout<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Post<\/a><\/div>
\"Google<\/a><\/div><\/div>","protected":false},"excerpt":{"rendered":"

SSL certificates encrypt and secure data. \u00a0The SSL certificate was designed to bring security to the internet A digital certificate is an electronic document that uses a digital signature to\u00a0bind a public key to an identify. \u00a0The certificate verifies that…<\/span><\/p>\n

Read more ›<\/a><\/div>\n

<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31,36],"tags":[],"class_list":["post-2851","post","type-post","status-publish","format-standard","hentry","category-security","category-technology"],"_links":{"self":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/2851","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/comments?post=2851"}],"version-history":[{"count":0,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/2851\/revisions"}],"wp:attachment":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/media?parent=2851"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/categories?post=2851"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/tags?post=2851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}