Visualize yourself standing in the middle of a crowd shouting out your personally identifiable information, your credit/debit card number and your home address. No one would ever risk doing this, because odds are in that crowd stands an opportunist who will capitalize on the situation and steal your information.However, when surfing the internet this precisely what we are risking. According to an annual survey conducted by analytics firm comScore and UPS found that 51% of consumers make their purchases online, often using a smartphone. In addition to shopping, consider the number of people who pay their bills online. Now people can even check on medical tests by logging into portals set up by their doctor’s offices. While extremely convenient, is level of security in place enough?
Hyper Text Transfer Protocol (HTTP) is the protocol over which data is sent between your browser and a website. The HTTP protocol sends data in plain text across the internet. In a nutshell, this means anyone can intercept and view the information being transmitted. It would be a complete disaster if private or financial information were available to anyone monitoring web traffic. As a result, we use HTTPS to protect transactions of a private nature on the internet and because HTTP lacks any security, there is a movement away from it all together. In fact, Google has already switched their basic search page to HTTPS.
Hyper Text Transfer Protocol Secure (HTTPS) is the secure version of the HTTP protocol. HTTPS pages typically use one of two protocols to encrypt communications between a browser and a website.
Web browsers such as Internet Explorer, Firefox and Chrome display a padlock icon in the address bar to visually indicate that there is an HTPPS connection. Additionally, some browsers have implemented color coding schemes to show the validity and safety of a website.
The TLS and the SSL protocols use a Public Key Infrastructure (PKI). PKI is a system which utilizes two 'keys' to encrypt communications. Commonly referred to a 'public' key and a 'private' key. Any encryption done with one of the keys must be decrypted with the other. In other words, anything encrypted with the public key must be decrypted utilizing the private key and vice-versa.
The 'private' key is the proverbial key to the kingdom. It should be protected and only be accessible by the private key owner. Public keys are intended to be distributed to anybody needing to decrypt information encrypted with the private key.
The ideas behind using HTTPS certificates are:
The reality is that no system is 100% secure.
Research which cipher is used and determine if updated versions of TLS are being used. If you use web browsers such as Internet Explorer, Chrome or Firefox; the instructions are similar and straightforward. Initially, enter the URL you want to check in the browser. Depending on the web browser, this can typically be done in 4 simple steps or less.
Internet Explorer Users:
Chrome Users:
Firefox Users:
All business should be on top of ensuring the encryption protocols are up to the highest standards. However, we as individuals should be proactive in protecting our information as well. Let’s be realistic though. If you are anything like me, you are not likely to take steps to determine the type of cipher used to encrypt the secure connection. Below are simple steps everyone should follow to stay secure online.
Proper encryption is vital to protecting data in transit. However, a data breach can occur with poorly configured servers. Remember, the use of HTTPS protocol vs. HTTP doesn't guarantee security. Use your best judgment and follow the best practices guidance. Flaws continue to surface; therefore businesses should continue to check the cipher used to encrypt the data to confirm it's the most updated and secure version. TechGuard can help identify and remediate vulnerabilities in the security configuration of your servers. Customers are more likely to trust and buy from sites that use HTTPS. Stories of attacks such as a BEAST attack remind us of the ever-present threats undiscovered vulnerabilities pose to sensitive data. Breaches are not just some unfortunate incident that happens to big companies. They impact small to mid-size businesses as well and often have devastating consequences. Security is a shared responsibility that we cannot take lightly.