Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.
Website Security Solutions
Showing posts tagged with Identity and Authentication Services
Showing posts in English
Quentin Liu | 29 Feb 2012 | 0 comments

The RSA 2012 Conference is this week, and I look forward to the usual exciting mix of reflection on the past year’s important trends, big announcements, and predictions on where things might go from here. For Symantec Authentication, this year’s RSA event carries added weight by falling roughly on the one and a half-year anniversary since Symantec acquired VeriSign. We’ve seen a lot of changes in the past 17 months, both within our company and in the IT industry at large, and the conference will be an excellent opportunity to share our observations and insights on both. There will be a lot to share, and I’m particularly eager to see what people have to say about a key issue that the Symantec Business Authentication team has been championing: Always On SSL.

As background, 2011 has earned ugly nicknames such as “Year of the Breach” and “Year of the Hack” for having the greatest...

FranRosch | 21 Feb 2012 | 0 comments

We are excited about hosting the CA/Browser Forum meeting this week in Mountain View and have a great set of attendees from the leading browser vendors and Certificate Authorities as well as several other interested third parties.  At Symantec, we believe that the CA/B Forum efforts to improve the SSL ecosystem have become even more important given the breaches and attacks over the past year.  The agenda this week is packed with some important topics including:

  1. Standards for improving the security related to CA operations
  2. Intellectual Property Sharing Policy
  3. Discussion on how we can evolve the CA/B Forum decision making process and how we can include the feedback from external third parties including Relying Parties
  4. Higher Authenticated Code Signing Certificates
  5. Certificate invalidation methods

One other topic sure to be discussed is the role of Domain...

Charla Bunton-Johnson | 17 Feb 2012 | 1 comment

This week has been a great one for Symantec at Parallels’ 2012 Conference in Orlando. Parallels attracts a global audience of over 1200 participants from across the cloud and hosting industries.

We are proud to share that Symantec has been selected by Parallels as its 2011 APS ISV Service Provider of the Year. We were also honored that Symantec’s Fran Rosch was selected to give a keynote at the event.

In addition to our activities at the conference, Symantec announced that it has extended its partnership with Parallels through the Application Packaging Standard (APS) and Parallels Automation for Cloud Marketplace (PACM) platform allowing Service Providers (...

FranRosch | 16 Feb 2012 | 0 comments

Symantec applauds Adam Langley's resolve to increase consumer safety on the web, however, his proposal to remove OCSP and CRLs in a future release of the Chrome browser is misguided and could potentially have dangerous implications. Mr. Langley argues that OCSP and CRLs do not work when needed, giving the example of a captive portal that requires you to sign in to an HTTPS site while blocking traffic to all other sites. This is a corner case that happens very infrequently. We argue that one shouldn’t discard OCSP and CRLs because they don’t work in a tiny fraction of cases.

Langley also expresses concern that the CA may experience downtime. Symantec has provided CRLs and OCSP responses with 100% uptime for at least the past 10 years. We serve over 3.5 billion OCSP lookups every day, allowing browsers to reliably receive real-time validation of SSL certificates. Rather...

Rick Andrews | 09 Feb 2012 | 1 comment

Recently, Ericka Chickowski with Dark Reading wrote a well thought out and researched piece discussing the future of web authentication.  Our own Quentin Liu was interviewed for the article. In her article, Ericka starts with a brief history of SSL and then goes into the current problems facing the CA community, followed by recommended best practices.  Ericka concludes that SSL has too long a history to completely scrap (amen!) and the industry must make changes in how SSL functions to improve security of web transactions.  We couldn’t agree more!

Key article points and commentary:

  • “Web authentication protocols took a pounding last year.”

    It’s true, there’s no denying that 2011 was riddled with high-profile attacks and targeting of CAs.  These attacks highlight that is has never been more important for organizations to know which CAs to trust.

  • “Taken as a whole, it...
Charla Bunton-Johnson | 07 Feb 2012 | 0 comments

This post was written by Zane Lucas, VeriSign Platinum Partner, Trustico, EMEA

With all the transitions in life, we are naturally nervous about change. We had this apprehension when we learned that the VeriSign Seal would be changing to a Norton Secured Seal. However, our fears were quickly put to rest by Symantec Trust Services (formerly VeriSign). Since 2003, Trustico has successfully partnered with VeriSign, and we’ve been fortunate to present the VeriSign Seal proudly on our website since that time. We will do the same with the new Norton Secured Seal. And with this new transition, we’ve found we’re not the only ones to feel at ease...

Paul Meijer | 03 Feb 2012 | 1 comment

As Sr. Director Infrastructure Operations, Symantec Authentication Services (including SSL, PKI, VIP, FDS), my team is responsible for operating and maintaining the infrastructure, which makes up the Authentication Services business. This is the same role I had while at VeriSign at the time when Symantec acquired the Authentication Services business in 2010.

In light of the recent announcement from VeriSign, Inc. that their corporate network was breached, people are wondering how we can be so certain in our public statements that the authentication networks were not compromised by the breach since the Authentication Services business was a part of VeriSign in 2010.

First, let me underscore that Symantec did not acquire VeriSign, Inc.  Symantec and VeriSign, Inc. are separate entities.  Symantec acquired assets from VeriSign that include the Trust Services (SSL) and User Authentication (PKI, VIP, FDS) businesses.

In keeping with industry best security...

FranRosch | 02 Feb 2012 | 3 comments

News broke recently that Verisign, Inc. reported in their quarterly SEC filings that they had been victims of a security breach in 2010. At this time, Verisign, Inc. has only confirmed that the incident did not impact their DNS business. 

Just as Verisign, Inc. stated that there was no impact to their production environment, I stand behind the following statement that Symantec made in response to media questions regarding the 2010 Verisign, Inc. security breach:

Symantec takes the security and proper functionality of its solutions very seriously.Trust Services (SSL), User Authentication (VIP, PKI, FDS), and other production systems acquired by Symantec were not compromised by the corporate network security breach mentioned in the Verisign, Inc. quarterly filing.

Unfortunately, many people are associating the breach at...

Michael Lin | 06 Dec 2011 | 1 comment

While presenting at the HostingCon earlier this year, some particular figures in my slide deck jumped out at me: 1) Corporations are seeing their information double every two years; and 2) Each day, 600 million emails are sent containing unencrypted confidential data. Those are staggering figures on their own. Put them together, and the need to protect sensitive data online becomes glaringly obvious.

The booming popularity of Secure Sockets Layer (SSL) Certificates and Extended Validation SSL (EV SSL) Certificates reflects the recognition that people and organizations must protect themselves from worsening malware, data breaches and other IT security threats. By validating user and...

Leelin Thye | 30 Nov 2011 | 0 comments

Today, Symantec is launching Symantec Certificate Intelligence Center as a generally available release after a successful public beta. Symantec Certificate Intelligence Center is a cloud-based service for enterprises to discover all SSL certificates, regardless of Certificate Authority (CA), and exercise end-to-end certificate lifecycle management.

The onslaught of news on security breaches related to SSL certificates such as weak 512-bit SSL certificates being issued by CAs, or stolen certificates being used to propagate cyber attacks, or even...