BRUSSELS |
BRUSSELS Feb 20 (Reuters) - European Parliament lawmakers voted on Wednesday against mandatory fines of up to 2 percent of global turnover for companies caught breaching consumer privacy, potentially limiting the impact of new data protection rules.The body's industry committee, including Liberal, Conservative and Socialist lawmakers, opted instead to allow national regulators to determine the size of fines.
In practice, maximum fines in the European Union currently only range from 300,000 to 600,000 euros.
The proposed data privacy legislation, first presented in January 2012, is due to go to a vote in the parliament later this year.
Consumer groups said Wednesday's committee vote would probably mean lower penalties for companies relying on unfettered access to clients' data which are caught breaking rules.
They said the committee also backed down from proposals which would have required customers to give their consent before companies can target them with advertising chosen according to their internet browsing habits.
"This consciously keeps consumers in the dark and affords - particularly US companies - a licence to collect and process personal data according to commercial interests," Monique Goyens from the pan-European consumer group BEUC said.
Data gleaned from monitoring which web sites people look at has proven a money spinner for tech start-ups, which earn money by allowing advertisers to target audiences more exactly. So if someone looks at web sites dealing with spa breaks, relatedadvertising will soon appear in their browser.
The industry committee is one of several which will consider the proposed legislation.
An Irish lawmaker from the committee whose job it is to consider the views of industry said he wanted to water down sanctions for small- and medium-sized companies.
"A warning as opposed to an immediate fine makes sense," Sean Kelly said. "The gravity of the offence needs to be taken into consideration."
Monday, February 25, 2013
Sunday, February 24, 2013
Analysis: The near impossible battle against hackers everywhere
Analysis: The near impossible battle against hackers everywhere
Analysis: The near impossible battle against hackers everywhere
SAN FRANCISCO |
SAN FRANCISCO (Reuters) - Dire warnings from Washington about a "cyber Pearl Harbor" envision a single surprise strike from a formidable enemy that could destroy power plants nationwide, disable the financial system or cripple the U.S. government.But those on the front lines say it isn't all about protecting U.S. government and corporate networks from a single sudden attack. They report fending off many intrusions at once from perhaps dozens of countries, plus well-funded electronic guerrillas and skilled criminals.Security officers and their consultants say they are overwhelmed. The attacks are not only from China, which Washington has long accused of spying on U.S. companies, many emanate from Russia, Eastern Europe, the Middle East, and Western countries. Perpetrators range from elite military units to organized criminal rings to activist teenagers.
"They outspend us and they outman us in almost every way," said Dell Inc's chief security officer, John McClurg. "I don't recall, in my adult life, a more challenging time."
The big fear is that one day a major company or government agency will face a severe and very costly disruption to their business when hackers steal or damage critical data, sabotage infrastructure or destroy consumers' confidence in the safety of their information.
Elite security firm Mandiant Corp on Monday published a 74-page report that accused a unit of the Chinese army of stealing data from more than 100 companies. While China immediately denied the allegations, Mandiant and other security experts say the hacker group is just one of more than 20 with origins in China.
Chinese hackers tend to take aim at the largest corporations and most innovative technology companies, using trick emails that appear to come from trusted colleagues but bear attachments tainted with viruses, spyware and other malicious software, according to Western cyber investigators.
Eastern European criminal rings, meanwhile, use "drive-by downloads" to corrupt popular websites, such as NBC.com last week, to infect visitors. Though the malicious programs vary, they often include software for recording keystrokes as computer users enter financial account passwords.
Others getting into the game include activists in the style of the loosely associated group known as Anonymous, who favor denial-of-service attacks that temporarily block websites from view and automated searches for common vulnerabilities that give them a way in to access to corporate information.
An increasing number of countries are sponsoring cyber weapons and electronic spying programs, law enforcement officials said. The reported involvement of the United States in the production of electronic worms including Stuxnet, which hurt Iran's uranium enrichment program, is viewed as among the most successful.
Iran has also been blamed for a series of unusually effective denial-of-service attacks against major U.S. banks in the past six months that blocked their online banking sites. Iran is suspected of penetrating at least one U.S. oil company, two people familiar with the ongoing investigation told Reuters.
"There is a battle looming in any direction you look," said Jeff Moss, the chief information security officer of ICANN, a group that manages some of the Internet's key infrastructure.
"Everybody's personal objectives go by the wayside when there is just fire after fire," said Moss, who also advises the U.S. Department of Homeland Security.
HUNDREDS OF CASES UNREPORTED
Industry veterans say the growth in the number of hackers, the software tools available to them, and the thriving economic underground serving them have made any computer network connected to the Internet impossible to defend flawlessly.
"Your average operational security engineer feels somewhat under siege," said Bruce Murphy, a Deloitte & Touche LLP principal who studies the security workforce. "It feels like Sisyphus rolling a rock up the hill, and the hill keeps getting steeper."
In the same month that President Barack Obama decried enemies "seeking the ability to sabotage our power grids, our financial institutions, our air traffic control systems," cyber attacks on some prominent U.S. companies were reported.
Three leading U.S. newspapers, Apple Inc, Facebook Inc, Twitter and Microsoft Corp all admitted in February they had been hacked. The malicious software inserted on employee computers at the technology companies has been detected at hundreds of other firms that have chosen to keep silent about the incidents, two people familiar with the case told Reuters.
"I don't remember a time when so many companies have been so visibly 'owned' and were so ill-equipped," said Adam O'Donnell, an executive at security firm Sourcefire Inc, using the hacker slang for unauthorized control.
Far from being hyped, cyber intrusions remain so under-disclosed — for fear leaks about the attacks will spook investors — that the new head of the FBI's cyber crime effort, Executive Assistant Director Richard McFeely, said the secrecy has become a major challenge.
"Our biggest issue right now is getting the private sector to a comfort level where they can report anomalies, malware, incidences within their networks," McFeely said. "It has been very difficult with a lot of major companies to get them to cooperate fully."
McFeely said the FBI plans to open a repository of malicious software to encourage information sharing among companies in the same industry. Obama also recently issued an executive order on cyber security that encourages cooperation.
The former head of the National Security Agency, Michael Hayden, supports the use of trade and diplomatic channels to pressure hacking nations, as called for under a new White House strategy that was announced on Wednesday.
"The Chinese, with some legitimacy, will say 'You spy on us.' And as former director of the NSA I'll say, 'Yeah, and we're better at it than you are," said Hayden, now a principal at security consultant Chertoff Group.
He said what worries him the most is Chinese presence on networks that have no espionage value, such as systems that run infrastructure like energy and water plants. "There's no intellectual property to be pilfered there, no trade secrets, no negotiating positions. So that makes you frightened because it seems to be attack preparation," Hayden said.
Amid the rising angst, many of the top professionals in the field will convene in San Francisco on Monday for the best-known U.S. security industry conference, named after host company and EMC Corp unit RSA.
Several experts said they were convinced that companies are spending money on the wrong stuff, such as antivirus subscriptions that cannot recognize new or targeted attacks.
RSA Executive Chairman Art Coviello and Francis deSouza, head of products at top vendor Symantec Corp, both said they will give keynote speeches calling for a focus on more sophisticated analytical tools that look for unusual behavior on the network — which sounds expensive.
Others urge a more basic approach of limiting users' computer privileges, rapidly installing software updates, and allowing only trusted programs to function.
Some security companies are starting over with new designs, such as forcing all of their customers' programs to run on walled-off virtual machines.
With such divergent views, so much money at stake, and so many problems, there are perhaps just two areas of agreement.
Most people in the industry and government believe things will get worse. Coviello, for his part, predicted that a first-of-its kind - but relatively simple - virus that deleted all data on tens of thousands of PCs at Saudi Arabia's national oil company last year is a harbinger of what will come.
And most say that the increased mainstream attention on cyber security, even if it fixes uncomfortably on the industry's failings and tenacious adversaries, will help drive a desperately needed debate about what do to internationally and at home.
(Reporting by Joseph Menn in San Francisco; Additional reporting by Jim Finkle in Boston and Deborah Charles in Washington; Editing by Tiffany Wu and Jackie Frank)
European Space, Industrial Firms Breached in Cyber Attacks: Report
By Oliver Rochford on February 24, 2013
European Aeronautic Defence and Space Company and ThyssenKrupp Breached, Germany Calls for Mandatory Breach Disclosure
German news magazine The Spiegel reported on Sunday that European Aeronautic Defence and Space Company (EADS) and German Industrial multinational conglomerate ThyssenKrupp, have fallen victim to recent cyber-exploitation attacks.
A few months ago, an “extraordinary attack” was launched against EADS, according to the report. The Company, however, has remained silent on the topic of any potential damage, but did rate the incident so severe that it alerted the German Federal government about it.
ThyssenKrupp fell victim to an attack in mid 2012, described as “heavy” and of an “exceptional quality”. The Company confirmed the incident to The Spiegel. According to sources, the breach occurred at a US-based subsidiary. The corporation has no knowledge whether anything at all, or anything specific was copied and stolen by attackers. The source addresses of the attacks appeared to be from China, according to the report. The report also states that the German Federal Agency for Constitutional Protection (Verfassungsschutz) registered 1100 exploitation attacks from foreign intelligence services, the majority of them targeting the Chancellery and Foreign and Economic Ministries using Spear-Phishing attacks.
German security agencies noticed a particular spike leading up to the G20 Summit, targeting the German members of the delegation, according to the Spiegel. The focus of interest appeared to be financial and energy policy related material. The Bundesnachrichten Dienst (BND, the German Foreign Intelligence Agency), is now reportedly planning to create a cyberwar department.
The Spiegel also reports that Germany's Minister of the Interior is now planning a IT Security Bill to implement a regulation requiring breaches and incidents to be reported by businesses, joining the EU commission which also is planning to require mandatory reporting of hacking for about 44,000 companies.
The full article from The Spiegel in German is available here.
Thursday, February 21, 2013
Monday, February 18, 2013
Monitoring Your Unknown Network Traffic
By Danelle Au on February 11, 2013
The recent New York Times hack was yet another high-profile attack that demonstrated the evolution towards multi-vector, sophisticated attacks. In this case, the mission of the perpetrators was very specific -- retrieving editorial information and data related to a particular story -- but it could easily have been nastier. With the extent of access the attackers had, the personal information of millions of New York Times subscribers could have been compromised.
The attack clearly demonstrated that a security strategy centered primarily on signature-based endpoint security isn’t enough to prevent against sophisticated attacks that use a cocktail of tactics, including advanced malware. We’ve seen this before. There is clearly a new cyber war being staged by a very different set of actors (nation states, political groups and criminal organizations) and much has been written about how to tackle these new sets of challenges.
What was interesting about this attack was that it emphasized the need for a rapid monitoring and response system. Hand-in-hand with the deployment of a robust security architecture is the need for a monitoring and response process that allows enterprises to continuously monitor and process security data efficiently and proactively act upon this data if something suspicious is found. But, delivering the proper monitoring and response infrastructure starts with feeding it the right information from your security appliances. Selecting the right enforcement model also makes the process of finding unknown traffic and potential malware more manageable.
Garbage In, Garbage Out
The first step is of course actually having useful security data to observe. The analytics of data is only as useful as the data itself, so logging capabilities must be enabled so there is enough data to capture network attacks or anomalies. Routers, switches and network security appliances generate logging and netflow data that can provide information about anomalous behavior within the network.
The challenge with a monitoring and response system is twofold. First, it must process large and complex security data sets in real time. Second, it needs to ensure it is processing useful, intelligent data. Recall the growth of the managed security services business just to handle the volume of IPS alerts generated by enterprises that had no idea how to react to them. Having too much data or data that is not easily actionable just brings operational headaches. Useful data includes information about applications, users and content that can shed light about traffic and user behavior.
A new breed of SIEM and big data vendors like Splunk understand this. They have the intelligence to process richer, premium feeds from next-generation firewalls that include information on applications, users and content for more flexible, analytic tools. Next-generation security appliances now also provide integrated reporting and logging tools that make the security administrator’s job a lot easier.
Looking for the Unknown Unknowns
With the richer data feed now driving more interesting and relevant dashboards and reports, how do you leverage this information to find the malware that may be in the network? What exactly are you looking for? Enter the Rumsfeldian theory applied to network security. In February 2002, Former Defense Secretary Donald Rumsfeld said this:
Positive enforcement means that you selectively allow what is required for day-to-day business operations and block everything else as opposed to a negative enforcement approach where you would selectively block everything that is not allowed. A negative enforcement approach requires you to keep track of any new applications and constantly adapt your policy to block them. This would be a never-ending, non-trivial task. The adoption of a positive enforcement model is therefore fundamental to identifying known applications so that unknown traffic becomes significant.
Here is how the categories apply to network security:
• Known unknowns – The known unknowns include unknown traffic and unknown files. Any traffic that is not categorized via any of the next-generation firewall application identification technologies is categorized as unknown TCP or unknown UDP. This may include custom applications, enterprise applications that have not yet been classified or malware. Within the enterprise network, there may also be unknown files that are downloaded by users that could be infected by malware. The strategy with the “known unknowns” is to eliminate or inspect. For example, by creating custom identifiers for internal applications, a certain amount of unknown traffic can be eliminated. All unknown files should be inspected to ensure that they do not have advanced malware, accomplished via advanced malware inspection technologies such as cloud-based processing of unknown files in a virtual sandbox to look for malware behaviors.
The attack clearly demonstrated that a security strategy centered primarily on signature-based endpoint security isn’t enough to prevent against sophisticated attacks that use a cocktail of tactics, including advanced malware. We’ve seen this before. There is clearly a new cyber war being staged by a very different set of actors (nation states, political groups and criminal organizations) and much has been written about how to tackle these new sets of challenges.
What was interesting about this attack was that it emphasized the need for a rapid monitoring and response system. Hand-in-hand with the deployment of a robust security architecture is the need for a monitoring and response process that allows enterprises to continuously monitor and process security data efficiently and proactively act upon this data if something suspicious is found. But, delivering the proper monitoring and response infrastructure starts with feeding it the right information from your security appliances. Selecting the right enforcement model also makes the process of finding unknown traffic and potential malware more manageable.
Garbage In, Garbage Out
The first step is of course actually having useful security data to observe. The analytics of data is only as useful as the data itself, so logging capabilities must be enabled so there is enough data to capture network attacks or anomalies. Routers, switches and network security appliances generate logging and netflow data that can provide information about anomalous behavior within the network.
The challenge with a monitoring and response system is twofold. First, it must process large and complex security data sets in real time. Second, it needs to ensure it is processing useful, intelligent data. Recall the growth of the managed security services business just to handle the volume of IPS alerts generated by enterprises that had no idea how to react to them. Having too much data or data that is not easily actionable just brings operational headaches. Useful data includes information about applications, users and content that can shed light about traffic and user behavior.
A new breed of SIEM and big data vendors like Splunk understand this. They have the intelligence to process richer, premium feeds from next-generation firewalls that include information on applications, users and content for more flexible, analytic tools. Next-generation security appliances now also provide integrated reporting and logging tools that make the security administrator’s job a lot easier.
Looking for the Unknown Unknowns
With the richer data feed now driving more interesting and relevant dashboards and reports, how do you leverage this information to find the malware that may be in the network? What exactly are you looking for? Enter the Rumsfeldian theory applied to network security. In February 2002, Former Defense Secretary Donald Rumsfeld said this:
“There are known knowns; there are things we know we know. We also know there are known unknowns; that is to say, we know there are some things we do not know. But there are also unknown unknowns – the ones we don’t know we don’t know.”Of course, his quote was referring to Iraqi weapons of mass destruction, but these categories apply to network security as well. In an ideal enterprise or data center network, you should know all your traffic, as any unknown traffic could include malware or a possible breach. But in order to easily categorize the unknown, you must start off with a positive enforcement model.
Positive enforcement means that you selectively allow what is required for day-to-day business operations and block everything else as opposed to a negative enforcement approach where you would selectively block everything that is not allowed. A negative enforcement approach requires you to keep track of any new applications and constantly adapt your policy to block them. This would be a never-ending, non-trivial task. The adoption of a positive enforcement model is therefore fundamental to identifying known applications so that unknown traffic becomes significant.
Here is how the categories apply to network security:
• Known knowns - If you apply a positive security enforcement model, then you are allowing approved traffic and blocking everything else. Next-generation firewalls do this by analyzing all traffic and decoding known applications and protocols using a combination of signatures, decoders and heuristics. The “known knowns” therefore are the applications that you are allowing in the network, safely enabled for specific users and network segments. The “known knowns” also means blocking traffic you know is bad. This includes controlling traffic sources and destinations based on risks such as blocking known bad URLs, blocking DNS to known bad hosts and domains, known exploits, malware and command and control traffic.
• Known unknowns – The known unknowns include unknown traffic and unknown files. Any traffic that is not categorized via any of the next-generation firewall application identification technologies is categorized as unknown TCP or unknown UDP. This may include custom applications, enterprise applications that have not yet been classified or malware. Within the enterprise network, there may also be unknown files that are downloaded by users that could be infected by malware. The strategy with the “known unknowns” is to eliminate or inspect. For example, by creating custom identifiers for internal applications, a certain amount of unknown traffic can be eliminated. All unknown files should be inspected to ensure that they do not have advanced malware, accomplished via advanced malware inspection technologies such as cloud-based processing of unknown files in a virtual sandbox to look for malware behaviors.
• Unknown unknowns – Assuming you’ve completed the first two steps above, you’re left with the unknown unknowns. This is where anomalous and malicious behavior can be observed. For example, look for concentrations of unknown traffic in one user or device, unknown traffic with a lot of bursty sessions (relative to bytes) across a lot of different ports or non-standard ports, or unknown traffic coming from certain countries. Encrypted unknown traffic that cannot be inspected can reasonably be blocked at this point. Further investigation can be launched on the rest of the “unknown unknowns” sessions such as drilling into the user or machine generating the traffic or whether the unknown application is transferring files.
In summary, just as building the right security architecture for your network requires the right security appliances, critical foundational elements like the right data feed and the right enforcement model are the building blocks to creating a robust monitoring and response system.Is SSL Secure?
Is SSL Secure?
Lucky13 SSL exploit reveals hidden risk in the pervasive security technology.
Secure Sockets Layer/Transport Layer Security is the foundational technology that secures Web transactions and communications, but it is not infallible.
New research dubbed Lucky13 reveals that SSL/TLS is at risk from a theoretical timing attack that could expose encrypted data. TLS headers include 13 bytes of data used for the secure handshake protocol, said researchers from Royal Holloway at the University of London, and they can be exploited in the Lucky13 attack.
The Lucky13 attack is not the first time in recent years that SSL/TLS has been found to be at risk. In September of 2011, the SSL BEAST attack was first reported. SSL BEAST was patched by Microsoft in January of 2012. The emergence of the new Lucky13 vulnerability is not a surprise to some SSL experts.
Ryan Hurst, CTO of GlobalSign, a SSL Certificate Authority, told eSecurity Planet that there has been some good research into SSL/TLS in recent years.
"Over the last two to three years we have started to see security researchers and universities taking research and seeing if it can be weaponized," Hurst said. "As a trend, I think we'll see more research into attacks that once were thought not to be possible, to actually be possible."
"Many people don't use HSTS, and there are plenty of opportunities to subvert SSL if you don't have a solid SSL configuration," Hurst said. "I don't want to trivialize the Lucky13 attack. It's cool research, but if I wanted to attack SSL I'd start with the initial connection."
HTTP Strict Transport Security (HSTS) is a recently ratified IETF standard to help ensure that browsers connect to a website over HTTPS. Without HSTS, it is possible for a user to insecurely log into a website that they should be logging into securely via HTTPS. At the Black Hat DC 2009 event, security researcher Moxie Marlinspike released a tool called SSLstrip that is able to deceive users and Web browsers into thinking they are on an SSL/HTTPS secured site when in fact they are not.
"In the case of SSL, I don't recommend people deploy CBC-based ciphers today because of Lucky13," Hurst said. "But is CBC fundamentally flawed? No, it just needs to be used right."
Hurst also suggests that users visit online SSL server validation tools, including one developed by his company. Security vendor Qualys also has an SSL checking tool. Those tools are able to look at a server configuration and make recommendations on proper deployment.
Another route to limit the risk of potential SSL vulnerabilities is for enterprises to have a solid grasp of the SSL certificates they are using and where they are being deployed. Jeff Hudson, CEO of Venafi, told eSecurity Planet that in his view most people don't know what they are using when it comes to SSL.
Venafi is a vendor of key and certificate management solutions. In Hudson's view, the Lucky13 vulnerability is not the first and won't be the last time that risks in SSL are exposed. "Any system of any kind of complexity always has vulnerabilities," he said.
For Hudson, managing SSL is all about trust and the ability to manage sources of trust in a rapidly evolving threat landscape.
"We do know that encryption and SSL certificates are foundational and we cannot get away from them as they are the very fabric of our digital world," Hudson said. "We can't change that; what you can do is get better at managing them."
Sean Michael Kerner is a senior editor at InternetNews.com, the news service of the IT Business Edge Network. Follow him on Twitter @TechJournalist.
New research dubbed Lucky13 reveals that SSL/TLS is at risk from a theoretical timing attack that could expose encrypted data. TLS headers include 13 bytes of data used for the secure handshake protocol, said researchers from Royal Holloway at the University of London, and they can be exploited in the Lucky13 attack.
The Lucky13 attack is not the first time in recent years that SSL/TLS has been found to be at risk. In September of 2011, the SSL BEAST attack was first reported. SSL BEAST was patched by Microsoft in January of 2012. The emergence of the new Lucky13 vulnerability is not a surprise to some SSL experts.
Ryan Hurst, CTO of GlobalSign, a SSL Certificate Authority, told eSecurity Planet that there has been some good research into SSL/TLS in recent years.
"Over the last two to three years we have started to see security researchers and universities taking research and seeing if it can be weaponized," Hurst said. "As a trend, I think we'll see more research into attacks that once were thought not to be possible, to actually be possible."
What Makes Lucky 13 Possible?
Why is an attack like Lucky13 theoretically possible today? It has a lot to do with increases in available computing and networking power. Though Lucky13 is a theoretically possible attack vector, hackers will likely not be interested in weaponizing it at the current time."Many people don't use HSTS, and there are plenty of opportunities to subvert SSL if you don't have a solid SSL configuration," Hurst said. "I don't want to trivialize the Lucky13 attack. It's cool research, but if I wanted to attack SSL I'd start with the initial connection."
HTTP Strict Transport Security (HSTS) is a recently ratified IETF standard to help ensure that browsers connect to a website over HTTPS. Without HSTS, it is possible for a user to insecurely log into a website that they should be logging into securely via HTTPS. At the Black Hat DC 2009 event, security researcher Moxie Marlinspike released a tool called SSLstrip that is able to deceive users and Web browsers into thinking they are on an SSL/HTTPS secured site when in fact they are not.
CBC Ciphers
One of the enabling factors for the Lucky13 attack is the usage of a weak CBC (cipher-block chaining) cipher. One of the ways to avoid the Lucky13 attack is to not use a CBC cipher, though Hurst notes that CBC can be implemented properly to limit risk. Getting CBC implemented right is no easy task and involves a lot of technical subtleties."In the case of SSL, I don't recommend people deploy CBC-based ciphers today because of Lucky13," Hurst said. "But is CBC fundamentally flawed? No, it just needs to be used right."
SSL Recommendations
For the Lucky13 attack, one possible fix to mitigate risk is on the server side implementations of SSL/TLS. Hurst suggests that all SSL server vendors, including OpenSSL and Microsoft, are now likely in the process of providing patches to their SSL/TLS servers to provide a constant time computation.Hurst also suggests that users visit online SSL server validation tools, including one developed by his company. Security vendor Qualys also has an SSL checking tool. Those tools are able to look at a server configuration and make recommendations on proper deployment.
Another route to limit the risk of potential SSL vulnerabilities is for enterprises to have a solid grasp of the SSL certificates they are using and where they are being deployed. Jeff Hudson, CEO of Venafi, told eSecurity Planet that in his view most people don't know what they are using when it comes to SSL.
Venafi is a vendor of key and certificate management solutions. In Hudson's view, the Lucky13 vulnerability is not the first and won't be the last time that risks in SSL are exposed. "Any system of any kind of complexity always has vulnerabilities," he said.
For Hudson, managing SSL is all about trust and the ability to manage sources of trust in a rapidly evolving threat landscape.
"We do know that encryption and SSL certificates are foundational and we cannot get away from them as they are the very fabric of our digital world," Hudson said. "We can't change that; what you can do is get better at managing them."
Sean Michael Kerner is a senior editor at InternetNews.com, the news service of the IT Business Edge Network. Follow him on Twitter @TechJournalist.
Friday, February 15, 2013
World’s Leading Certificate Authorities Come Together to Advance Internet Security and the Trusted SSL Ecosystem
Posted by admin on February 14, 2013
San Francisco, CA. – February 14, 2013 – Leading global certificate authorities announced the creation of the Certificate Authority Security Council (CASC), an advocacy group, committed to the exploration and promotion of best practices that advance the security of websites and online transactions. Through public education, collaboration, and advocacy, the CASC strives to improve understanding of critical policies and their potential impact on the internet infrastructure. Members of the CASC include Comodo, DigiCert, Entrust, GlobalSign, Go Daddy, Symantec, and Trend Micro.
Click to Tweet: World’s leading Certificate Authorities join together to form the Certificate Authority Security Council: http://bit.ly/VaZNek
Amid increasing threats from sophisticated hacker networks, global cybercriminal organizations and state-sponsored espionage, the CASC is coming together to promote advanced security standards, encourage best practices, and ultimately improve the deployment of a continually trustworthy SSL ecosystem. In addition, the CASC supports the efforts of the CA/Browser Forum and other standards-setting bodies in their important work, and will continue to help develop reasonable and practical enhancements that improve trusted Secure Sockets Layer (SSL) and certificate authority (CA) operations.
Coinciding with its launch, the CASC is announcing the first of a planned series of educational and advocacy efforts related to best practices in SSL deployment with a focus on the importance of online certificate status checking and revocation. Specifically, the CASC will highlight the benefits of online certificate status protocol (OCSP) stapling for Web server administrators, software vendors, browser developers, and end-users through blog posts, conference presentations and other resources. For more information, visit: http://bit.ly/V01LhG
The backbone of Internet security for nearly two decades, the SSL protocol and certificates from publicly trusted CAs remain the most proven, reliable and scalable method to protect Internet transactions. The CASC is focused on promoting tightened global standards to mitigate high-profile security incidents, and improving research and collaboration that will continue to establish the security-robustness of the SSL ecosystem.
Click to Tweet: World’s leading Certificate Authorities join together to form the Certificate Authority Security Council: http://bit.ly/VaZNek
Amid increasing threats from sophisticated hacker networks, global cybercriminal organizations and state-sponsored espionage, the CASC is coming together to promote advanced security standards, encourage best practices, and ultimately improve the deployment of a continually trustworthy SSL ecosystem. In addition, the CASC supports the efforts of the CA/Browser Forum and other standards-setting bodies in their important work, and will continue to help develop reasonable and practical enhancements that improve trusted Secure Sockets Layer (SSL) and certificate authority (CA) operations.
Coinciding with its launch, the CASC is announcing the first of a planned series of educational and advocacy efforts related to best practices in SSL deployment with a focus on the importance of online certificate status checking and revocation. Specifically, the CASC will highlight the benefits of online certificate status protocol (OCSP) stapling for Web server administrators, software vendors, browser developers, and end-users through blog posts, conference presentations and other resources. For more information, visit: http://bit.ly/V01LhG
The backbone of Internet security for nearly two decades, the SSL protocol and certificates from publicly trusted CAs remain the most proven, reliable and scalable method to protect Internet transactions. The CASC is focused on promoting tightened global standards to mitigate high-profile security incidents, and improving research and collaboration that will continue to establish the security-robustness of the SSL ecosystem.
Quotes
CASC Quote- “SSL remains today the most widely deployed and successful cryptography system in the world,” said Dean Coclin, Steering Committee, Certificate Authority Security Council. “As a unified group of the world’s leading SSL providers, we’re collaborating on matters of highest priority, while also recognizing the value of previous and recent work to continually evolve the standards, and create an industry that understands the issues involved and is committed to making the necessary enhancements.”
- “The CASC is a group of global trust anchors, who understand the necessity for continually evolving security that meets the needs of web sites and their users,” said Yngve Pettersen, Independent Researcher. “The creation of the CASC is a step in the right direction to making practical, scalable improvements to the current SSL/TLS ecosystem while promoting security standards and better education among users.”
- “The CASC members are working actively with browsers and other parties to further improve existing methods that effectively balance performance and security while providing a trusted experience for all internet users,” said Ben Wilson, Chair, CA/Browser Forum. “These collaborative efforts have led to important steps forward that help improve security practices, self-regulation, and globalize the adoption and implementation of stricter, more universal standards. We look forward to working with the CASC to set quality standards that raise the bar for everyone.”
Additional Resources
- CASC Website
- CASC Blog
- CASC Blog Post: CAs Unite
- CASC Blog Post: OCSP Stapling Improved Performance & Security a Win-Win
- CASC Initiative: Certificate Revocation and OCSP Stapling
- SSL Basics
- OCSP and CRL Performance Report
- CA/Browser Forum Baseline Requirements
- CA/Browser Forum Network Security Guidelines
- AlwaysON SSL
- Advancing Internet Security SlideShare Presentation
- SSL Configuration Checker
About the CASC
The Certificate Authority Security Council is comprised of leading global Certificate Authorities that are committed to the exploration and promotion of best practices that advance trusted SSL deployment and CA operations as well as the security of the internet in general. While not a standards-setting organization, the CASC works collaboratively to improve understanding of critical policies and their potential impact on the internet infrastructure. More information is available at https://casecurity.org.
###
Subscribe to:
Posts (Atom)