Recently, Ericka Chickowski with Dark Reading wrote a well thought out and researched piece discussing the future of web authentication.  Our own Quentin Liu was interviewed for the article. In her article, Ericka starts with a brief history of SSL and then goes into the current problems facing the CA community, followed by recommended best practices.  Ericka concludes that SSL has too long a history to completely scrap (amen!) and the industry must make changes in how SSL functions to improve security of web transactions.  We couldn’t agree more!

Key article points and commentary:

• “Web authentication protocols took a pounding last year.”

  It’s true, there’s no denying that 2011 was riddled with high-profile attacks and targeting of CAs.  These attacks highlight that is has never been more important for organizations to know which CAs to trust.
   

• “Taken...

As Sr. Director Infrastructure Operations, Symantec Authentication Services (including SSL, PKI, VIP, FDS), my team is responsible for operating and maintaining the infrastructure, which makes up the Authentication Services business. This is the same role I had while at VeriSign at the time when Symantec acquired the Authentication Services business in 2010.

In light of the recent announcement from VeriSign, Inc. that their corporate network was breached, people are wondering how we can be so certain in our public statements that the authentication networks were not compromised by the breach since the Authentication Services business was a part of VeriSign in 2010.

First, let me underscore that Symantec did not acquire VeriSign, Inc.  Symantec and VeriSign, Inc. are separate entities.  Symantec acquired assets from VeriSign that include the Trust Services (SSL) and User Authentication (PKI, VIP, FDS) businesses.

In keeping with industry best security...

While presenting at the HostingCon earlier this year, some particular figures in my slide deck jumped out at me: 1) Corporations are seeing their information double every two years; and 2) Each day, 600 million emails are sent containing unencrypted confidential data. Those are staggering figures on their own. Put them together, and the need to protect sensitive data online becomes glaringly obvious.

The booming popularity of Secure Sockets Layer (SSL) Certificates and Extended Validation SSL (EV SSL) Certificates reflects the recognition that people and organizations must protect themselves from worsening malware, data breaches and other IT security threats. By validating user and device identity, SSL and EV SSL...

Malaysia just can’t catch a break lately. Earlier this month it was discovered that  Malaysian certificate authority,  DigiCert Sdn. Bhd. (no relation to DigiCert, Inc.) had been issuing weak 512-bit SSL certificates, a serious no-no in the CA business. This led to the major browsers yanking DigiCert Sdn. Bhd. from their trusted root stores. Then last week a story broke in which a code signing certificate had been stolen from a Malaysian government agency and used to sign malware that exploits a vulnerability in Adobe Acrobat 8.  

An investigation found that the certificate was issued by DigiSign Server ID to a domain managed by the Malaysian Agricultural Research and Development Institute. Although the certificate has since expired, Malaysian authorities say the certificate was stolen “some time ago”.  

I’ve read a number of articles on this subject since the story broke and each article makes mention of this being the...