Why SSL Certificates Are Mandatory and What You Can Do

Cybercriminals are becoming increasingly aggressive. In the first 6 months of 2017, we’ve seen mounting evidence of state-sponsored ransomware, leaks of spy tools from U.S. intelligence agencies, campaign hacking and more daring attempts at stealing confidential information from private corporations and small businesses.

Google has mandated that websites (especially those engaged in ecommerce) should get SSL Certificates not only for security purposes but also to improve their SEO rankings. The search engine giant has included SSL as a factor in its search algorithm since 2014 but it has become more important with the updated version of Google Chrome.

But these cybercriminals will never stop because hacking has become a lucrative profession. They work round-the-clock to stay ahead of the latest security protocols including SSL Certificates.

Yes, cybercriminals have found ways to circumvent the filters provided by SSL Certificates. Still, SSL remains a vital component in your data protection and security checklist.

If your website procures confidential information or stores valuable data such as a subscriber or user base, you should get SSL certificates. But it is not enough to simply have the certificates. You must manage them responsibly.

SSL Encrypted Malicious Attacks are Rising in Frequency

Cybersecurity firm Zscaler reports that from January to August of 2017, it encountered 8.4 Million malicious attacks through SSL encrypted traffic. 7% of the malicious software or 600,000 were categorized by the company as “advanced threats”.

Zscaler also identified an average of 12,000 phishing attempts per day that bypassed the encrypted protocol. This number represents an alarming 400% increase from 2016.

According to Zscaler’s Senior Director of Security Research and Operations, Deepen Desai, hackers are using SSL as a way to conceal device infections, data exfiltration and to control communications.

SSL works to ensure the security of network traffic within an enterprise. It sits between the users and the Internet; inspecting every byte that traverses online traffic including those that have encryption. This way potential threats are intercepted before they can do damage to your network.

If you want to learn more about SSL Certificates, you can refer to our article “SSL: What It Is And Why Your Business Needs It”.

What has caused the increase in SSL- encrypted cyber crime? It is basically the natural process of adaptation.

SSL Certificates had become highly effective in stopping website infiltrations and malicious attacks. This means that the cybercriminals simply had to develop new technologies that would enable them to sidestep the security filters.

Another cyber security firm, Venafi reported that over the past year alone, 90% of IT firms in the United Kingdom saw a higher than 25% increase in the use of encryption solutions.

Venafi surveyed more than 500 companies that had employed at least 1,000 personnel. The survey covered companies located in the United Kingdom, Germany, France and the United States so Venafi could better understand the different ways encryption certificates are being used.

The interesting statistic uncovered by the study was that 90% of the CIO’s of the companies surveyed revealed that they were already attacked or at the very least under threat by malware concealed within the certificates.

Venafi concluded that the rise in malicious attacks through encryption had a direct relationship with the increase in the use of certificates. The reason?

Companies that acquired the SSL did not manage the keys and certificates responsibly.

Basically these companies lost track of how many certificates and keys they owned leaving many sites vulnerable. They unwittingly opened doors for hackers to sneak in and manipulate the certificates to suit their own selfish needs.

 The SSL Process

Let’s take a look at how the SSL process works in order to have a better understanding on why it is important to manage your SSL Certificates responsibly and make sure they are updated.

The SSL process involves authentication and data encryption. Given the volume of activity on the Internet, encryption is very important to ensure all data packets are protected during transmission.

The problem in the SSL process usually lies in authentication which covers the digital certificates.

What is a digital certificate?

It is essentially a data file which contains key information about the website’s certificate holder. The digital certificate is used to verify the authenticity of the website. Among the information indicated in the certificate are:

• Web server’s host name
• Issue and expire time
• Public key for the web server

This is what a digital certificate looks like:

There are 2 types of certificates: trusted and untrusted.

Trusted certificates reside on the web browser and are signed by a recognized Certificate Authority (CA) which is an entity that is authorized to sell certificates. Untrusted certificates are self-signed and require manual installation on the web browser.

For purposes of this article, we will only focus on the process covering trusted certificates.

These are the steps involved during a web server/ web browser certificate exchange:

1. Open your browser and type in a URL.
2. The web server of the URL will receive the request for the website or web  page.
3. The web server will respond by returning the certificates to your web browser.
4. Your web browser will conduct a number of inspections such as expiration of the certificate and hostname on the certificate.
5. Your web browser will notice the certificate from the website was signed with the CA’s private key.
6. Your web browser will immediately check its certificate database if it has the CA’s certificate information.
7. Once the certification information is found, your web browser will use the public key to validate the signature on the certificate sent by the website.
8. If the certificate signature has been validated, your web browser will know the CA can be trusted. It will now also trust the web server of the website.

From this process summary, you can see why it is important to have your certificates updated. In step number 4, the expiration date on the certification will be checked and validated.

If your SSL Certificates are expired, your site is vulnerable to infiltration and other forms of malicious attacks.

As we mentioned in our previous article “SSL Basics: Why You Need It to Protect Your Website from Hackers”, the most common mode of attack is for hackers to upload a listening program on the web server. Once you type in your confidential information, the program will capture it and send it back to the hacker.

Getting SSL Certificates for your website is a definite step in the right direction. But acquiring protection is one thing; making sure it is implemented and running 24/7 is another.

If your website provides your bread and butter, you should do everything within your power to protect it from anyone with bad intentions. The Internet is rife with opportunities and opportunists. One act of carelessness or irresponsibility may be all it takes to destroy everything that you have worked hard for.

Would you spend a fortune on a home then disregard the value of a comprehensive insurance plan? Acquiring SSL Certificates is your insurance plan for your website. But it will have no value once it is expired.

What You Can Do

At this point; and after 3 articles, we hope we have made our position very clear:

If your website requires users to disclose confidential or personal information, you should secure it with SSL Certificates.

Then take the time to make sure these certificates are managed effectively.

Is there a way to ensure the integrity and effectiveness of the certificates? Yes by acquiring them from a reputable CA and have it managed by a third party service provider you can trust.

Mountaintop Web Design can offer you both! We are authorized to sell SSL Certificates and we can manage these for you so that you can dedicate all your time and energies squarely on your business.

We’ve installed and kept the certificates updated for our clients. Never lose sleep at night thinking cybercriminals are hatching diabolical plans to steal your data.

If you want to know more about the SSL Certificates we offer, please give us a call or drop an email. We will get back to you as soon as possible because we understand that every second your website remains exposed, the risk of long term and large scale damage becomes greater.