Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.
Website Security Solutions
Showing posts in English
AllenKelly | 06 Oct 2011 | 0 comments

As you may already know, VeriSign Authentication Services became part of Symantec in August of 2010. Since then, we’ve continued to invest in and enhance your SSL Certificates—adding more value and providing even more protection for your business—while still giving online customers the greatest confidence that your website is secure. Since we became part of Symantec we’ve delivered:

  • Express Renewal and AutoRedeem/AutoPay Renewal Services Learn more

  • Vulnerability Assessment Learn more

  • Symantec Certificate Intelligence Center...

FranRosch | 23 Sep 2011 | 0 comments

All of the SSL and CA related activity in our industry is getting noticed by the press.  Symantec strongly believes that now is the time for the industry to pull together and focus on improving our operations and practices across areas such as:

  • CA application and network infrastructure
  • Authentication standards and practices
  • Auditing and Reporting
  • Breach Notification and Response

Check out the article that I think really captures this approach:

http://www.eweek.com/c/a/Security/CAs-Need-to-Invest-in-Infrastructure-Stronger-Business-Processes-360681

FranRosch | 13 Sep 2011 | 0 comments

The recent DigiNotar and Comodo Certificate Authority (CA) security breaches have once again highlighted the need to create standards for stronger security around SSL business operations and authentication processes.  At Symantec, we believe that the industry needs to work together to develop stronger security policies and procedures in three areas and then implement third party monitoring of adherence to these policies by the CA community.  These three areas are:

1.     CA Infrastructure:  Rigorous and diligent upkeep of CA security infrastructure is critical, components of which include:

·       Specifically-designed hardened facilities and physical security measures to defend against attacks

·       Hardware-based cryptographic signature systems

·       Regular third party...

AllenKelly | 12 Sep 2011 | 0 comments

Symantec® announced today the availability of Symantec Certificate Intelligence Center for public beta.  Symantec Certificate Intelligence Center helps organizations discover SSL Certificates, regardless of issuing CA, across their entire network, and manage the entire lifecycle of SSL Certificates.  This is an add-on option for existing VeriSign® MPKI for SSL customers.

Symantec created this service after hearing from their enterprise customers on the need for an easy-to-deploy SSL Certificate discovery and management system to help provide inventory visibility, ensure business continuity and increase operational efficiency. Other capabilities in the service include:

  • a distributed architecture to enable parallel and fast discovery scans
  • flexible scanning parameters...
AllenKelly | 08 Sep 2011 | 0 comments

This is the second part of a two-part series on the proper management of SSL Certificates.

In Part I of this series, we discussed some of the risks and implications of poorly managed SSL Certificates.  When SSL Certificates expire or become compromised, the need to rectify the situation quickly is paramount. Take the example of a recent incident where a Certificate Authority (CA) was compromised. Customers of that CA may want to take appropriate actions quickly to minimize any cascading impact from that security breach. Unfortunately, if the customers do not have a robust SSL Certificate Management System, they may not know their level of threat exposure.

Many organizations recognize the risks and implications of out-of-status SSL certificates....

FranRosch | 07 Sep 2011 | 1 comment

Since my last post, the effects of the recent DigiNotar breach have spread across the security industry. Many media outlets recently shared some of the names of the 531 fraudulent certificates created, including Google, Facebook, Skype, Microsoft, as well as each of the major certificate authorities. A hacker has claimed responsibility for the breach and claims to have breached some other Certificate Authorities as well. GlobalSign has ceased issuing certificates as it investigates whether or not it has been breached. Pundits are questioning the strength of SSL. Then, yesterday a Dutch government agency erroneously made a statement that Thawte had been breached. Although the statement was proven false and quickly...

AllenKelly | 01 Sep 2011 | 0 comments

On August 17th eWeek ran an article that described how improper SSL implementations can leave websites vulnerable to various cyber attacks.  While this story is spot-on, what is equally important to consider is the proper management of SSL Certificates. The mismanagement of SSL Certificates can lead to financial loss and lack of credibility for your organization.

One particular challenge that enterprises face can be having hundreds of SSL Certificates and no proper SSL Certificate management tool. The status of each certificate is usually tracked manually on a spreadsheet or through some other manual mechanism.  Manual mechanisms are prone to human error, and what’s more, data is difficult to track when IT personnel changes.  In addition, it isn’t unheard of for an SSL Certificate to expire in the middle of the...

FranRosch | 31 Aug 2011 | 0 comments

The Internet is buzzing with news of a recently compromised Certificate Authority (CA), DigiNotar, owned by VASCO Data Security International, Inc., possibly compromising a large number of consumers.

In July of this year an internal audit discovered an intrusion within DigiNotar’s CA infrastructure indicating compromise of their cryptographic keys. The breach of these keys resulted in the fraudulent issuance of public key certificates to a several dozen domains including the domain Google.com. Shortly after the incident DigiNotar revoked all of the certificates in question, conducted an additional external security audit and then attempted to revoke outstanding certificates that were affected. As of July 19th, DigiNotar believed all fraudulent certificates were taken out of circulation by revocation.

Unfortunately this week it was found that there were still instances of fraudulent certificates still in circulation. On August 28, 2011 a false DigiNotar wildcard...

RyanWhite | 14 Jul 2011 | 0 comments

Surveys are a great window into people’s minds, especially when they can illuminate contrasting, and even contradictory, behaviors in the same group. Results from the Symantec Online Internet Safety Survey have done just that. The most compelling finding – that respondents frequently proceed with online transactions they know might be insecure – inspired me to ask not just, “What are they thinking?” but “What are they thinking?!?”

The survey’s focus must be on many people’s minds, as we’ve had an extraordinary response – 301 people in just a few days! My initial impressions of the results are below. Feel free to share your comments and questions here.

Findings

Risky behavior remains common despite respondents knowing better: What struck me the most was that in many cases, respondents continued...

Christina Rohall | 28 Jun 2011 | 0 comments

...on behalf of Michael Lin, senior director of Trust Services

A recent flurry of media stories and blog posts has debated which technology is more crucial for online security: Domain Name System Security (DNSSEC) or Secure Sockets Layer (SSL) encryption?  The very question itself indicates that confusion may still exist over what each technology does – and how they actually work best together.

DNSSEC ensures that people reach the real IP address of the websites they seek. More specifically, DNSSEC authenticates the origin and integrity of DNS data as that data traverses the Internet. The technology helps thwart man-in-the-middle attacks and DNS cache poisoning, where cybercriminals corrupt stored DNS data to direct website visitors to fraudulent sites. The Online Trust Alliance recommended organizations support of DNSSEC in their latest scorecard,...