The Changing Face of SSL

Transcription

1 The Changing Face of SSL New Realities Demand New Approaches Trend Micro, Incorporated» SSL underpins almost all online transactions today and the way SSL is sold is exposing organizations to excessive cost and risk. With increasing online and cloud deployments, a new approach is needed. A Trend Micro White Paper April 2012

2 TABLE OF CONTENTS Introduction 3 SSL Delivers Secure Communications 3 Attacks Highlight the Frailty of the Traditional SSL Businesses 4 How Many Certificates Do I Need And How Much? 5 A New Model Is Needed For Buying SSL Certificates 6 Introducing Trend Micro SSL: A Different Approach to SSL 7 Conclusion: It s Time For a Change 9 Page 2 of 9 Trend Micro White Paper The Changing Face of SSL

3 INTRODUCTION Global businesses and governments today face an increasingly difficult task of dealing with threats to their online applications, ranging from straightforward malware through to nefarious advanced persistent threats (APTs). Securing these organizations cannot be accomplished through a single security measure, although there are some solutions that can provide broad protection from a number of threats. The use of SSL encryption to protect the transmission and integrity of confidential information online is one of them. With widespread changes in the way we deliver services, exploding growth in the use of mobile devices, and increasing adoption of cloud computing, organizations are increasingly at risk of compromise. This extended enterprise is further put at risk by the ever evolving means of stealing information and compromising services, something that organized crime and some nation states have focused significant energy on because of the enormous potential rewards. SSL encryption, an established and proven technology, can protect communications in server to server, mobile devices, cloud applications, and other endpoints in order to mitigate the risk of data loss and other negative impacts. While the technology of SSL remains sound, it is the business of SSL that represents a fundamental challenge to securing on-line transactions into the future. Specifically, the traditional per-certificate pricing and deployment model burdens organizations with high costs and complexity. At the same time, the use of Figure 1: Web server growth has exploded, highlighting increasing online business- - and need for SSL. Source: Netcraft, June 2012 subcontracted, third party issuers often called affiliates creates opportunities for attackers to obtain SSL certificates fraudulently and use them maliciously. The numerous successful attacks perpetrated on Certificate Authority (CA) affiliates in 2011 and into 2012 have highlighted challenges in the way that SSL certificates are sold. In addition, the increasing use of cloud computing and ongoing growth in online applications has brought to the forefront the fact that current selling models for SSL certificates are a thing of the past and need to be modernized. SSL DELIVERS SECURE COMMUNICATIONS Secure Sockets Layer (SSL) is today s de facto communication security protocol. At its base level, it provides a secure channel between two devices communicating over the Internet or an internal network. In most cases, SSL is used when a web browser needs to securely connect to a web server over the Internet. But with the increasing use of cloud computing, there are more and more application-to-application connections that must also be secured with SSL. Page 3 of 9 Trend Micro White Paper The Changing Face of SSL

4 The underlying success of SSL is the simplicity to the end user. SSL is a very transparent protocol, requiring little to no interaction from the end user when initiating a secure session. For example, when using a web browser and an Organization Validated (OV) or Domain Validated (DV) certificate is used on the server, the end user is shown that they Figure 2: Extended Validation (EV) SSL Certificates Enable Browsers to Clearly Show a Connection is Secure. are using SSL through the display of a yellow padlock; in the case of Extended Validation (EV) certificates, the address bar also turns green. The EV certificate clearly stands head and shoulders above other certificate types particularly Domain Validated (DV) certificates for clearly demonstrating the security of a site and establishing trust with the visitor. While it should be used pervasively throughout the Internet, its use has been hampered because of the artificial financial barrier of traditional pricing models that charge an exorbitant premium for these certificates. If SSL is not used to protect the session, this leaves normal website traffic using the basic HTTP protocol, which by its very nature is not secure and subject to eavesdropping attacks. If used to transmit sensitive information like credit card details and account logins, this can give attackers access to online accounts and other private information, often leading to fraud, identity theft, or intellectual property loss. ATTACKS HIGHLIGHT THE FRAILTY OF THE TRADITIONAL SSL BUSINESSES Throughout 2011, SSL was in the news in ways and volume that it had never been in the past. The focus of the publicity was not something that the industry wanted, as it was the result of many attacks and breaches against SSL providers. Interestingly, the primary attack point was not typically against the root CA, but instead against smaller affiliates used to sell certificates on their behalf. The incidents forced many organizations to reissue new SSL certificates from another provider, as the trust they had established with the issuer was no longer valid. In one extreme case Diginotar the CA itself ended up declaring bankruptcy their certificates were no longer trusted. Figure 3: 2011 Saw Focused Attacks on SSL Providers The attacks highlight an important issue with the way that SSL certificates are sold around the world today. In addition to direct selling, an affiliate or partner model is typically used in the SSL industry to maximize potential revenue and distribution for the larger root CAs. Page 4 of 9 Trend Micro White Paper The Changing Face of SSL

5 The primary root subcontracts out to smaller, regional business affiliates to leverage the larger brand and issue certificates on their behalf. The affiliates essentially become a root of trust without having the same rigorous auditing and security applied to them as the primary root. This long-standing practice is focused on CA vendors maximizing revenues, not on increasing the overall security and trust of online communication. Even with all of the adverse publicity, these vendors have made virtually no change in the way SSL certificates are sold around the world because it would break their out-of-date business model. HOW MANY CERTIFICATES DO I NEED AND HOW MUCH? With the traditional SSL business model, certificates are sold on a per-certificate basis. This means that every time you need to use an SSL certificate, you have to buy one. Of course, there are options for high-volume purchasing from the major providers, but this assumes that you know how many certificates you are going to need at any given time, and you will eventually run out of the purchased pool. In the past, when a small organization might have had only one server, this was not an overwhelming issue. As organizations move more and more applications online and to the cloud, the challenges increase. First, there are simply going to be more servers that need to be secured, translating into higher costs. Second, the ability to predict how many applications and certificates are going to be needed will be of paramount importance. For example, if an online store that normally needs five servers with SSL and needs to burst in capacity for the Christmas season, how many will it need? It is not unusual to see organizations triple or even quadruple their capacity during peak times, which means they will have to purchase SSL certificates that are valid for a year or more, simply to accommodate a 1-2 month window of need. Finally, internal and test servers often need SSL certificates for security reasons. To avoid cost, most organizations take on the burden of using a self-signed certificate (issued internally from a CA), which can introduce significant overhead to the process of moving a server from internal to external. This expense and unpredictability is further exacerbated by the range of options that have been built up on these certificates over time. These options were not designed to provide value to the customer; they are instead designed to extract additional revenue for the certificates that have the most impact to the trust of visitors to a web site. Where it used to be I need an SSL certificate, it s now much more complicated. At the lowest level, there are three distinct types of SSL certificates (see Figure 4 below). However, most CAs have added various options that quickly add up to a substantial increase in cost. Examples of this include Wildcard certificates (which enable you to secure a website domain and an unlimited number of its sub-domains) and Subject Alternative Names (SANs) (which let you protect multiple host names with a single SSL certificate). Prices for all of these options from the main CA vendors will range from hundreds to thousands of dollars per certificate, which is both confusing and expensive. When you layer in the need for flexibility in the cloud, the potential for high expense quickly increases! Page 5 of 9 Trend Micro White Paper The Changing Face of SSL

6 Figure 4: Types of SSL Certificates Certificate Types: Domain Validated (DV) SSL is where the CA only checks the right of the applicant to use a specific domain name via an challenge. No company information is checked and therefore company information is not displayed within the certificate. Although this means that issuance time is fast (often in minutes), this is a very low value certificate and is the topic of much debate in the industry. Some members of the CA/Browser Forum, including Trend Micro, believe that this type of SSL certificate should not be allowed because it delivers a false sense of security. As a result, Trend Micro SSL does not issue DV certificates. Organization Validated (OV) SSL provides a basic level of vetting of an organization before a trusted SSL certificate is issued. The issuing CAs check the right of the applicant to use the specified domain name and also check into the existence of the organization itself. This vetted company information is displayed to end users when viewing the certificate details, giving more visibility into the organization behind the site. Much more secure than a DV certificate, issuance of an OV certificate can often take days due to the requirement to vet the organization. Extended Validation (EV) SSL delivers the highest level of consumer trust through the strictest authentication standards of any SSL certificate. Extended Validation verification guidelines, created by an independent body, require issuing CAs to obtain and verify multiple pieces of identifying information about the organization and organizational contact listed in the enrollment. EV certificates enable consumers to easily understand that they are on the correct web site through visual cues, including the very obvious green bar that shows up in the browser. The guidelines for Extended Validation vetting are published by the CA/Browser Forum and can be found here. A NEW MODEL IS NEEDED FOR BUYING SSL CERTIFICATES At the same time as the need for secure web communications is growing exponentially, the challenges of the traditional SSL business make it harder and harder for organizations to leverage this well-established method of securing online communications. The current distribution models of major SSL providers are putting the very trust that organizations have in SSL in jeopardy in order to maximize revenue. Although any and all organizations that are online may become targets of attacks, clearly these smaller, less controlled affiliates (or subcontractors) are not as capable of protecting the trust that has been extended to them. In addition, the way that certificates are priced in the industry simply does not reflect the way that organizations need to use SSL today. Organizations need the ability to issue the right certificate for the job (e.g. an EV certificate for all customer facing web sites, publically rooted for all internal and test servers) and not compromise security for cost. Organizations also need the ability to work in the dynamic world of cloud computing in a natural way, without concern for unnecessary high costs to accommodate needed capacity. Page 6 of 9 Trend Micro White Paper The Changing Face of SSL

7 INTRODUCING TREND MICRO SSL: A DIFFERENT APPROACH TO SSL As a global leader in security, Trend Micro saw our customers struggling with the reality of today s SSL business and the needs of tomorrow around cloud security. It became clear that a new approach to the SSL business was required; one that could provide our customers with the means to secure all communications in a significantly more trusted and more cost-effective way. Given that most organizations are in the growth phase of embracing the power of cloud computing and will continue to need SSL security for traditionally deployed applications, Trend Micro believes SSL is a natural offering from a world leader in security. In mid-2011, Trend Micro acquired AffirmTrust, an up-and-coming SSL provider, to form the basis of new way of delivering SSL capability to its customers. AffirmTrust provided the ability to issue widely trusted certificates with a team of proven SSL experts to support the service. This was the same team that grew GeoTrust into a leading global brand for SSL certificates. Members of this widely respected team were also founding members of the CA/Browser forum, the key industry body for SSL. Building on this acquisition enables Trend Micro to deliver a new SSL business model with SSL certificates that are trusted across over 99% of browsers and backed by the support of proven SSL security experts. Trend Micro SSL marks a new way of delivering SSL capability, where trust is not subcontracted to third parties for certificate issuance and a per-certificate model that forces organizations to compromise on trust is a thing of the past. A Revolutionary Pricing Model That Delivers the Lowest Cost The Trend Micro SSL service is built on an innovative business model that allows unlimited OV (Organization Validation) and EV (Extended Validation) SSL certificate deployment for dramatic savings versus traditional SSL suppliers. This empowers organizations with the ability to deploy widely trusted certificates (over 99% coverage) with the highest security possible (EV certificates) without bearing the high cost and effort levels required by other vendors. Trend Micro SSL customers get all of this for one low, flat rate that will save significant amounts of acquisition and management costs, and naturally fits the dynamic nature of the cloud. The Highest Level of Trust for SSL Certificate Issuance To preserve the security of the issuance process, Trend Micro SSL will exclusively deliver SSL certificates directly to its customers. This removes the risk associated with other vendors use of affiliates, subcontractors or LRAs (local registration authorities) to generate and issue certificates that has been the focus of attacks in the past. Instead, Trend Micro will leverage its relationships with known, trusted customers. Page 7 of 9 Trend Micro White Paper The Changing Face of SSL

8 In addition, Trend Micro SSL customers are free to deploy the latest in SSL certificates including Extended Validation (EV) for increased user trust in the online session, without concerning themselves with the potentially enormous prices charged by traditional vendors. With the Trend Micro SSL unlimited certificate model, organizations are also empowered to use publically rooted certificates in test and internal environments, increasing overall trust across the business. The Most Agile & Flexible SSL Certificate Service With Trend Micro SSL, customers can respond instantly to meet all of their SSL certificate needs, especially dynamic cloud requirements, without the typical arduous registration and purchase requirements demanded by per-certificate vendor models. Trend Micro SSL leverages its relationship with existing customers, enabling instant and unlimited SSL certificate issuance. With coverage across over 99% of standard and mobile browsers, support for key certificate capabilities like Universal Communication Certificates (UCC) and the ability to issue unlimited SSL certificates, Trend Micro SSL customers can deploy trusted certificates when and where needed. This includes EV certificates to get the green bar in the browser for the ultimate in security and trust. By removing per-certificate pricing, customers can directly leverage the full-featured web-based administration console to issue and manage certificates on demand in an intuitive, streamlined way. A Robust Service Delivered by Security Experts As an award-winning global security leader, Trend Micro has extensive experience in securing high-volume, transaction-based environments, and providing unparalleled ease of administration and affordability. Trend Micro SSL joins other security services from Trend Micro, including the Smart Protection Network (SPN), a cloud-based service focused on gathering, analyzing, and distributing critical information in real time to over 130 million endpoints around the world. The SPN service is supported by over one thousand dedicated security researchers with a singular focus securing Trend Micro customers. Trend Micro is experienced in dealing with demanding environments that require rapid response and maximum uptime. Coupled with the experienced Trend Micro SSL security team that is delivering the service, organizations can be confident in moving to a trusted partner like Trend Micro. Page 8 of 9 Trend Micro White Paper The Changing Face of SSL

9 CONCLUSION: IT S TIME FOR A CHANGE For too long, efforts to maximize trust between organizations and their online users has been thwarted by an SSL business model focused on maximizing revenue for the SSL vendors. With the increasing demands of the cloud environment and greater exploitation of conventional certificate issuance schemes, now is the time for change. Trend Micro SSL is delivering an unprecedented approach to SSL security by providing an unlimited pricing model with the industry s highest security issuance process. No longer will organizations have to worry about cost when deploying SSL they will be empowered to use the right certificate and as many as needed to address online security. Trend Micro is focused on Securing Your Journey to the Cloud, and SSL underpins this journey in a fundamental way. With this revolutionary unlimited certificate pricing model and direct selling to only our customers, Trend Micro SSL delivers a unique solution that focuses on delivering value to our customers, not on maximizing profits at the expense of trust and security. Take the next step to learn how you can change the way you look at SSL security. Go to to learn more. TREND MICRO Trend Micro Incorporated is a pioneer in secure content and threat management. Founded in 1988, Trend Micro provides individuals and organizations of all sizes with award-winning security software, hardware and services. With headquarters in Tokyo and operations in more than 30 countries, Trend Micro solutions are sold through corporate and value-added resellers and service providers worldwide. For additional information and evaluation copies of Trend Micro products and services, visit our Web site: TREND MICRO INC. U.S. toll free: phone: fax: by Trend Micro Incorporated. All rights reserved. Trend Micro, the Trend Micro t-ball logo, OfficeScan, and Trend Micro Control Manager are trademarks or registered trademarks of Trend Micro Incorporated. All other company and/or product names may be trademarks or registered trademarks of their owners. Information contained in this document is subject to change without notice. [WPXX_Title_120328US] Page 9 of 9 Trend Micro White Paper The Changing Face of SSL