News broke recently that Verisign, Inc. reported in their quarterly SEC filings that they had been victims of a security breach in 2010. At this time, Verisign, Inc. has only confirmed that the incident did not impact their DNS business. 

Just as Verisign, Inc. stated that there was no impact to their production environment, I stand behind the following statement that Symantec made in response to media questions regarding the 2010 Verisign, Inc. security breach:

Symantec takes the security and proper functionality of its solutions very seriously.Trust Services (SSL), User Authentication (VIP, PKI, FDS), and other production systems acquired by Symantec were not compromised by the corporate network security breach mentioned in the Verisign, Inc. quarterly filing.

Unfortunately, many people are associating the breach at Verisign, Inc. with...

Some of the files associated with the new W32.Duqu threat were signed with a private key. After intense investigation we concluded that the private key used for signing these Duqu files was stolen from a Symantec customer whose systems appear to have been compromised. The private key was associated with a code signing certificate issued to that customer.

A Stolen Key

We take this very seriously and quickly revoked the customer code signing certificate in question. We have found no evidence of any breach to our systems and our records show that the code signing certificate was issued only after completing our rigorous customer authentication process. Our systems, roots and intermediate CAs were never at risk.

Running the world’s largest commercial cyber-intelligence network, Symantec is constantly monitoring the internet and customer environments in search of...

The recent DigiNotar and Comodo Certificate Authority (CA) security breaches have once again highlighted the need to create standards for stronger security around SSL business operations and authentication processes.  At Symantec, we believe that the industry needs to work together to develop stronger security policies and procedures in three areas and then implement third party monitoring of adherence to these policies by the CA community.  These three areas are:

1.     CA Infrastructure:  Rigorous and diligent upkeep of CA security infrastructure is critical, components of which include:

·       Specifically-designed hardened facilities and physical security measures to defend against attacks

·       Hardware-based cryptographic signature systems

·       Regular third party...

Since my last post, the effects of the recent DigiNotar breach have spread across the security industry. Many media outlets recently shared some of the names of the 531 fraudulent certificates created, including Google, Facebook, Skype, Microsoft, as well as each of the major certificate authorities. A hacker has claimed responsibility for the breach and claims to have breached some other Certificate Authorities as well. GlobalSign has ceased issuing certificates as it investigates whether or not it has been breached. Pundits are questioning the strength of SSL. Then, yesterday a Dutch government agency erroneously made a statement that Thawte had been breached. Although the statement was proven false and quickly retracted, it highlights the...