SSL Certificates knowledge center - ClickSSL

Importance of VPN Technology & Useful Tips

nills04@gmail.com (Nill Smith) — Fri, 19 May 2017 05:49:00 -0700

In today's digitally connected world, user safety is the most important factors to keep in mind. Through the internet you can now do lots of different work like watching a movie, reading news, buying products and flight booking through various portals or website. But when you are connected to the public or unsecured network for doing personal or business work, you need to make sure all your data securely transfer. The recent study shows that most of the online security breach happened because of not implementing proper security systems and policy. You need a Virtual Private Network (VPN) service to secure your identity through a secured channel of security.

What is VPN (Virtual Private Network)

VPN (Virtual Private Network) technology used to encrypt information through creating a secure connection between a user system and web host server. VPN technology helps you to protect your identity and location from hackers and crackers. Once you installed VPN software in your system through a trusted and reliable source, you can select different IP address based on country and server location to access your selective website. VPN will encrypt your information through an SHA (Secure Hash Algorithm) method and maintain your online privacy in a home or public network.

Benefits of VPN

1. Security In Public Hotspots

When you use a public network to access any information such as news, emails, videos, there is a risk of data theft from if the website is untrusted. VPN encrypt your information and transfer through a secured channel, and therefore your data will be secure in a public WI-FI hotspot like restaurant or coffee shop.

2. Access Restricted Information

Some content such as videos, movies, news and products prohibited in certain countries. That is because those countries follow some particular rules and regulation for their native. Suppose you are on holiday in such selective countries, you might not be able to watch your favorite show, local news or download some files due to their restriction policy. Through VPN technology you can access your all famous TV Show and download files even if you're using their internet service. VPN offers you to access any website from different countries server location.

3. Sharing Files in Private

VPN offers you to share your secured files and relevant documents to your friends without any trace. VPN tools provide you a new location to share all your documents, and no other online bots can track your identity quickly. So once you start using VPN service, your online identity will be secured.

4. Support Multiple Device

Internet service is now available in every digitally connected device such as desktop, tablet, and mobile. Just like in Desktop, we also want to be secure on mobile and tablet devices. Nowadays popular VPN service providers offering multiple device support to ensure the highest level of security on every device.

Common Tips Before Selecting VPN Service

1. Customer Support

Using a VPN tools is very fast and easy, you just need to follow some simple installation process. But sometimes you might face certain difficulties like switching between server location, installation setting in the mobile and tablet device, frequent crash error, etc. Buying VPN products from the reputed brand will give benefits of 24x7 customer support, so that you can get a proper solution to your query at anytime and anyplace.

2. Anti-Malware Protection

Anti-Malware Protection is a security feature that protects your system from downloading a virus, or malware loaded files travel over the different spam website. It is always recommended to the user, before proceeding with any downloads or transaction always ensure the site follows proper security measures. If the website is concerned about their user privacy and safety, they will install a reputed SSL Certificate on their server. Popular VPN reseller offers Anti-Malware protection to ensure visitor can access world information without any restriction.

3. Maximum Number of Server Support

Before selecting any VPN service providers always verify the list of the country location they offer to access. Sometimes you may need to watch a program of a particular country that allows watching only for those people who lived there. If you want some information on a particular country, make sure the VPN service provider are offering maximum server support for that region.

4. Update Your VPN Tools Frequently

To avoid any error in your VPN software such as a frequent crash or security loophole. Always update your software frequently. Updating software is required to get new features and improved level of security that is missing in the previous version.

Conclusion

VPN service is very useful if you stay connected to the internet for a long time. It will protect your identity and secure your personal details. But it also essential that you should follow some guidelines to take maximum advantages of this technology without affecting your online privacy.

Importance of Cyber Security Globally

nills04@gmail.com (Nill Smith) — Fri, 24 Feb 2017 05:35:00 -0800

We live in an incredible digitally connected world. We spend our half of the total daytime on social media, games, trading, online transaction and even much more. Every time we connect to the internet, our data is visible to hackers because we are ignoring basic security instructions. There are many reasons for cyber-attacks like inadequate technology, lack of security education, accessing insecure website and portals. In today's era when we are managing our 70% of the data over the internet, we should care about cyber security, whether it is commercial business or residential household.

Internet-based industry such as e-commerce, banking, traveling, insurance and cloud-based is giving high priority to the cyber security. However, companies also accept their safety does not reach to optimum level because they lack of proper security related education in their organization. According to ITRC (Identity Theft Resource Center) report, until July 2016, there were more than 522 data breaches. The report also states that data breach is now diversifying into different sectors such as federal agencies, healthcare, and telecom. Many popular companies such as Centene, Federal Bureau of Investigation, Seagate and Internal Revenue Service are the notable examples of data breach in the USA. Such data breaches cause loss of personal information like Name, Contact Number, Social Security Number and ID cards on a large scale. In 2016, the total cost of cybercrime reached to $450 billion globally. There are various types of cybercrime attacks used by cybercriminals for various purposes such as data breach, vulnerability and much more. The major cyber-attacks are.

Cyber Fraud
Malware Attacks
Social Engineering Attacks
Technical Attacks
Vulnerability Exploitation
Login Attacks

#1. Cyber Fraud Cyber fraud is a process where cybercriminal tries to steal your money, personal, property and financial information. There are different types of cyber fraud such as Phishing attacks, Spear Phishing attacks, unauthorized disclosure, and Whaling.

#2. Malware Attacks

in this type of attack, the malware comes from specific files such as .exe source and adware. The virus activates just after you open the file and in cases, malware file download on your PC without your authorized approval.

#3. Social Engineering Attacks

This attack is currently popular because it targets mainly to non-technical person through the phone internet call such as Skype. They present themselves as company authorized or technical support guys and asked for your personal information such as name number and Ids for regular database updates.

#4. Technical Attacks

Mainly target Organization technical systems such as Database, DNS, and outdated software. There are different types of Technical Attacks that hackers are using and DOS attacks are one of the well-known types, where attacker disrupts the internet usage of the user. Web Page Defacing is a type of attack where a hacker breaks the web page security and change to page visibility such as design and text to warn the owner about the lower level of data security.

#5. Vulnerability Exploitation

Make sure you get your software update from authorized source, because most of the vulnerability attacks come with software updates. In Vulnerability attacks, hackers inject the code in the program, and when the user tries to run that program, the hackers get their desired result.

#6. Login Attacks

Such attacks directly target your personal accounts such as email, bank and social media platforms. Some common login attacks are brute force, password cracking and oAuth exploits. The hackers mainly target large firms such as Google, Microsoft and Sony. Therefore, such companies have some strong organization security rules for their employees. But it doesn't mean small and medium firms are safe. Every organization must set some strict rules to avoid major security threats. Below are some common security rules that every company must follow.

Keep your necessary software and system up to date.
Create an internal policy to avoid using external drive such as pen drive, memory card or external hard disk with informing technical person. Also block certain website such a free software download, free shareware, and spam sites responsible cyber-attacks.
Cloud service is adopted by many companies because cloud service is cost efficient and easy to access from anywhere.
Educate your employee about cyber threats and how you can avoid malware downloads.
Encourage your employee to use a secure password (alphanumeric, symbol) and change after a period.

Cyber security is a prime issue and must require a specialization to tackle sophisticated cyber threats. The security person must think out of the technical details and should aware to latest cyber-attacks and data breach methods and provide efficient solution to overcome these issue. The Organization responsibility is to set some important policy to avoid entrance of virus and malware through small storage devices like Pen drive and Memory Card. Keeping an eye on cyber security is the only possible solution to prevent cybercrime.

Benefits Of Domain Validation (DV) SSL Certificates

nills04@gmail.com (Nill Smith) — Fri, 10 Feb 2017 01:52:00 -0800

Have you ever think, that how much your website is secure from hackers, spyware and malicious attacks? In the recent report of Kaspersky Lab states that last year 47.48% financial, 10.17% E-Shop, 25.76% E-banks and 11.55% E-payment attacks blocked by their security software. If you think your website is having spyware, then you need to think twice before login in your admin panel. If you are running a small-scale website like blogs or a medium scale website like a locally targeted online store, you must take advantage and secure your site through inexpensive Domain Validation Certificates.

Domain Validation (DV) SSL Certificates are highly used and simple solution to secure your single domain or associated domain with single certificates. Domain Validation Certificates usually issued within a minute. Therefore, you do not have to wait for long. All verification process is completed through a predefined automated process and no Human interference and no Organization validation process involved. It secures only your Domain, web mails, logins and more.

The Primary Benefits of Domain Validation Certificates

1. Low Price:

Compare from other expensive validation SSL certificates. Domain Validation (DV) SSL Certificates are quite inexpensive and easy to validate your single domain and associated domain.

2. Issuance within Minute:

DV SSL Certificate does not involve any human verification, and all process is finished through a predefined verification process. So your certificate will be issued within a short time.

3. Advanced Protection:

DV SSL certificates offer a high level of data encryption security, means your user data will be secured with 2048-Bit Key and 256-Bit of SSL encryption.

4. Improve User Trust:

HTTPS is the prime factors of visitor confidence. It secures visitors, their data is secured from phishing, and spyware attacks.

5. Help in Search Engine Ranking:

Google has announced to give ranking benefits to the website that provides SSL encryption. Therefore, DV SSL is also an important part of your site ranking.

Primary Feature of DV SSL Certificates.

Certification Key: 2048-Bit Key Length & 256-Bit Key SSL Encryption Issuance: Within Minutes Validation: Domain Only Algorithm Support: SHA-2 Enable Browser Support: 99.9% Desktop & Mobile Browser Support Validation: Domain Validation Additional: secures WWW and non-WWW domains. Seal: Security Site Seal Additional Support: Wildcard and Multi-Domain SSL Certificates

Some Popular Inexpensive Domain Validation SSL Products

1. RapidSSL Certificates:

Provides high security to small and medium scale website, such as ecommerce website with 99% browser compatibility. Certificate Authority: RapidSSL Price Start: $11.66/year Supported Algorithm: SHA-2 enabled Warranty: USD $10,000 Warranty Server License: Unlimited Certification Encryption: 2048-bit key length & 256-bit Certificate Encryption

2. Comodo Positive SSL Certificates:

It is world’s most trusted online security provider. Comodo offers an inexpensive range of Domain Validation SSL Certificates with the highest level of data security. Certificate Authority: Comodo Price Start: $12.00/year Supported Algorithm: SHA-2 Enabled Warranty: USD $10,000 Warranty Server License: Unlimited Certification Encryption: 2048-bit key length & 256-bit Certificate Encryption

3. Thawte SSL123:

Small-scale Company who is looking for only domain validation with 256-Bit encryption. Then Thawte SSL123 is the best choice for you. Certificate Authority: Thawte Price Start: $29.70/year Supported Algorithm: SHA-2 enabled Warranty: USD $500,000 Warranty Server License: Unlimited Certification Encryption: 2048-bit key length & 256-bit Certificate Encryption

4. GeoTrust QuickSSL Premium:

It is specially designed for ecommerce website security; GeoTrust QuickSSL Premium secures your visitor information like username, email address, and transaction. Certificate Authority: GeoTrust Price Start: $58.50/year Supported Algorithm: SHA-2 enabled Warranty: USD $500,000 Warranty Server License: Unlimited Certification Encryption: 2048-bit key length & 256-bit Certificate Encryption Be Safe & Be Secure

Important Checklist for Website Security

nills04@gmail.com (Nill Smith) — Fri, 20 Jan 2017 23:17:00 -0800

Whether you are launching a new website or running a successful existing online business/personal website, you must check your system security frequently to avoid unpredictable cyber and malware attacks. Last year 51% percent of US adults suffered from some security vulnerability issue also estimated global cost of the cyber-attack reached to $400 yearly. Nowadays website security is important for everyone whether it is small blogger, locally based online store or large e-commerce seller. If your site is dealing with user data such as name, email, postal address and card details then you must check below mention tips to avoid any loss hacking and malware attack.

There are various small factors responsible for big cyber and malware attacks, which administrator does not take into account. Some common factors responsible for malware attacks are outdated CMS, old password and not using secured encryption connection.

#1. Keep Software Up to Date:

To prevent your website vulnerabilities and compatibility issue, keep your Content Management System (CMS) up to date. World`s most popular CMS like WordPress, Joomla, and Drupal frequently update their system and send the notification to their user. Make sure you update your CMS, important plugins, and software to avoid general malware and breach issue.

#2. Use Secure Passwords & Update frequently

Some most common login passwords like "admin" admin123" and "password" are very easy to crack. Keep your password strong and must be having alphanumeric and special character. Change your password after a certain time to avoid any misuse. Keep your security question uncommon and never disclose the answer to anyone.

#3. Data Validation Must Be Done from Server-Side

Websites like blogs, News and E-commerce place some JavaScript for data validation. Sometimes these data are validated through client-side, but sometimes it is not safe because hackers can easily catch your password from the page source. Data validation from server side adds an extra layer of data security because it follows some certain safety rules to block malware software intended to breach user data.

#4. Backup Regularly

Scheduling an automatic backup may save your time and money every time. Backup take some extra space from your current storage space. However, it's good to keep the backup on a regular basis.

#5. Set up SSL Connection

When we talk about data security. SSL Certificate is the most important option available for encryption. SSL certificate like Comodo SSL, Symantec SSL, RapidSSL and Thawte SSL certificates are some of the most popular brands in Data security & encryption industry. Based on your website nature and requirement you can buy SSL certificate start from $11 with instant issuance.

#6. Reduce SQL injection vulnerabilities

SQL Injection is some of the most popular techniques used by hackers to grab personal information. Through placing a dynamic code in the query server, hackers can easily access your website personal information like user name, address and credit card details. Some common guidelines to avoid SQL injection vulnerabilities are.

Validate all SQL input correct
Use predefined query instead of a dynamic query.

With these common recommendations, you can protect your important data hacking and malware attacks. Help you to build strong customer trust and improve sales.

Why Your Website Need SSL Encryption Security?

nills04@gmail.com (Nill Smith) — Fri, 6 Jan 2017 01:50:00 -0800

Nowadays everyone likes to purchase from the website, and online transaction is a big part of that. In a recent report, cybercrime found that more than 30,000 websites are infected every day with malware and their data stolen by unknown hackers. The primary reason for website hacking and malware attacks are using old version CMS (Content Management System) and plugin for long-time and sometimes not using SSL (Secure Sockets Layer) Certificate on the website.

What Happen When You Do Not Use Data Encryption

Medium and Small scale business sites such as personal blogs, local stores, and local news sites are easy targets for online hackers because those website does not plan to spend on their website data security. Without encryption security, hackers can steal your private data such as email address, password, and credit card details and can easily misuse them. According to Wall Street Journal, the estimated loss from cybercrime is $100 billion every year. If you are running an online business or any online activity where customers need to share personal details, then your website needs SSL encryption protection.

What is SSL Certificate

SSL Certificate creates an encrypted connection between server and browser through a key pair (a public and a private key). These certificates also contain website owner information, which is known as "Subject.".

How SSL Certificate Works

To get an SSL certificate, you need to first create a CSR (Code Signing Request) on your website hosting server. This process gives you two pair of keys (Public and Private Key) file. Once you received the CSR data file, you need to send the public key file to SSL Certificate issuer also known as Certificate Authority or CA. When SSL Certificate issuer received the public key file, they create a structure to match your private key. The SSL Certificate issuer can never see your private key data. After the completion of SSL certificate verification, when a browser tries to access your website protected by SSL certificate, the browser and server connect through SSL connection. Anything sends from the browser in encrypted form through public key can only decrypt from the private key install on the server.

Benefits of SSL Certificate

Essential in Online Payment System:

Any online business whether large, medium or small scale required SSL certificate to meet Card Payment Industry guidelines. PCI (Payment Card Industry) verify the SSL certificate is obtain from a trusted SSL authority and providing a secure private connection in the pages where customer needs to enter their personal details.

Protection against Phishing:

Replicate or fraud website do not get SSL certificate easily. If a visitor is completely aware of SSL protection, they will simply move from such untrusted website without any further action.

Improve Customer Trust:

A Customer can easily check whether the website is secure from SSL certificate with the help of site seal and green bar. Website with SSL certificate will increase customer trust and confidence of online purchase.

Types of SSL Certificate

There are various types of SSL certificate products and brands are currently available in the market, based on your website type and requirement you can buy SSL certificate. For better understanding, you can also visit SSL Certificate Finder page.

Some Popular SSL Certificate Products

Conclusion

A perfect SSL certificate can improve visitor trust through its green padlock, https protocol encourage visitor's to make the transaction with confidence.

Cyber Security Awareness Program (CSAP) for Organizations

nills04@gmail.com (Nill Smith) — Thu, 29 Jan 2015 03:51:00 -0800

CSAP: An inevitable task for an every organization

How much employees in your organization are aware of cyber security. The big question is threatening every organization in this age is security of their cerebral property. On one side, cyber crime is stepping quickly in our daily life. Organization and web users are still not aware about this rising risk of the Cyber Crime. How organizations can fight against rising cyber crime? The simple answer is bringing security awareness in every department of organizations. Conduct a security awareness program for the entire organization and provide security training for selected employees according to business requirements.

When employees fall into a cyber culprit?

Employees innocently access to malicious websites or download software that contains malware or virus. They click on spam emails or phishing emails, which can redirect them to a phishing site to steal their information or money. Sometime employees share their password to an unknown person or transfer data with plugging infected USB drives, which can lead them into trouble.

What should include Cyber security Awareness Program?

CSAP – Cyber Security Awareness Program is essential part of organization. Oregon Government has approved a plan in 2006 to implement security awareness training. The security awareness should obey the following IT standards, laws and regulations, and official guidance documents as:

ISO 17799
COBIT 4.0
HIPAA (Privacy & Security Rules)
GLB-A
PCI Data Security Standard
FISMA
NIST SP 800-16
NIST SP 800-50
Section 508 of the Rehabilitation Act
Oregon Accessibility Policy

Best Practices for Security Awareness Program:

The Best Practices identified by the Oregon Government for security program are as follows:

Security awareness program is compulsory for the entire staff.
All third parties who have access to the organization's information should participate in the security program.
The program should start with the introduction of an organization's security policy and expectations.
The entire staff must recognize about the organization's information security policy.
At least once per year, the entire staff should have security training.
Periodic reminder should be sent to all the employees.
Management leaders must attend a security program.
Security awareness must be given according to the base of roles and responsibility of employees.
Common level of security training should be given to all staff.
Security awareness program should comprise information of known threats, security needs, legal liabilities, business controls, contact person for incident reporting.
Employees should be advised about the importance of security in their personal life.
Take a help of external training experts and benchmark for further guidance.
IT tools should be used to automate training session.
Records of staff training should be kept in staff records.
Use qualitative and quantitative metrics for getting feedback and check the effectiveness of the program.

It is clear that a proper strategy and planning is required to implement effective security awareness programs. However, before building a security training program, there are a few recommendations on which I would like to focus.

Few DON'Ts:

Do not ignore Training content Update:
Do not stick with old training program and keep it updated. It should be relevant, precise, and interesting for the employees.
Do not rely on only White paper Training:
Make some interesting video and PowerPoint for training program purpose instead of printed white paper. Run a training video contest for the user that fills employees with excitement and energy.
Do not puzzle between cyber security awareness and security training:
Cyber security awareness changes the behavior of individuals that strengthens security culture while security training provides knowledge about different security aspects.
Do not ignore anyone:
Set a security awareness program for every employee of the organization. This is the best way to mitigate security risk in an organization.
Do not focus only on security compliances:
Security awareness is a continuous process therefore, cover every topic, and keep updating it according to business and technology changes.

Few DOs:

Take Support of top Management Executives:
Compel top executives and middle managers to attend the security awareness program to make other employees aware about their experience.
Conduct Program in an interesting way:
Add competition or learning techniques in security program to make the entire program effective and interactive.
Use different sources of information:
Always use images, newsletters, and blogs to provide refreshing security information to keep trainees updated.
Focus on awareness material:
Make a useful and flexible awareness material that employees can use it outside the work premise and can share with family / friends to spread security awareness.
Get feedback and measure success:
Get the feedback of employee's like and dislike, effectiveness of the program, and take suggestions to make a better awareness program.

In Addition, employees should be permitted to read security material periodically. Few online materials should be provided by organization, for example; ClickSSL regularly publishes Weekly Infosec Snipper on their blog. Therefore, Employees should be permitted to read such security updates on first day of every week.

Correlation between Dedicated IP and SSL

nills04@gmail.com (Nill Smith) — Wed, 18 Dec 2013 04:33:00 -0800

What is Dedicated IP exactly stand for? This is indeed a basic question that needs to be understood by any techno savvy person. However, before going to reveal about dedicated IP let us understand IP address. IP address serves two main functions including network interface identification and location addressing. Generally, there is 32-bit IP address is in use, which is known as IPv4 but due to growth of internet, IP designers now using 128-bit IP address, which is called IPv6. There is a lot of debate on whether to choose dedicated IP or not, we have to look at dedicated IP, and other aspects.

What is Dedicated IP?

It is easy to remember and assigned to each device that is participating in computer network used for communication. A dedicated IP is only devoted to a single server and not shared with other server. Many shared hosting providers charge normal fee to provide dedicated IP.

Speed and Dedicated IP:

Dedicated IP can also provide website speed though multiple source of traffic is handled by a single IP. Every server examines a packet, and request and then deliver the traffic to particular domain. In this case, number of destination is not significant, the process of website loading time can be slightly influenced which is not a serious concern.

Why SSL needs Dedicated IP?

When you have ecommerce website where online shoppers carry online transactions with their debit-credit card, or with online banking, you need an SSL on your website to protect ongoing transactions between the user and the company server. SSL certificate authenticates the server with IP address and verify the IP address assigned to the particular server. When a client connects to the server for a different domain name, the server gets confused about which certificate to show to the client. This process is defined in below example.

Example of SSL and Static IP:

For instance, there are two domains called www.abc.com and www.xyz.com and both domains are hosted on a single IP address (for example 000.000.0.0). Now a person has opted SSL for a domain called www.abc.com on his website with that IP address. However, the person wants to access https://www.xyz.com the browser will check for SSL and if it is fail to make secure connection for particular website, then browser will show a name mismatch error.

Advantages of Dedicated IP:

You have less downtime compare to Shared IP.
If you are ecommerce merchant then you should have your own SSL with a dedicated IP.
Many web-hosting providers need a unique IP to access anonymous FTP function.
Shared IP address may have security threat due to shared among multiple website while dedicated IP has less chance of security threats.
With static IP, you will have easy remote access of your PC from wherever you operate it.
There are chances of blacklisted website on shared IP address (If there is blacklisted website) on contrary, dedicated IP has less chance of blacklisted.

Alternate Solutions to Dedicated IP:

SNI (Server Name Indication): SNI is an extension to SSL that allows the client to include hostname in the first SSL handshake so, the server identifies the correct virtual host name for which the request is made, and the server can easily set up the connection.
Wildcard Certificate: Using Wildcard certificate user can secure unlimited sub domains under a single IP address. You can include sub domains like www.example.com, webmail.example.com etc.
SAN Certificate: Subject Alternative Name (SAN) can secure up to 25 domain names, sub domains with a single certificate.

Finally, it is up to user and its type of business whether to choose dedicated IP or shared IP. Dedicated IP is quietly considerable in SSL and especially when you have a single website.

Viber came again under attack of Syrian Electronic Army

nills04@gmail.com (Nill Smith) — Mon, 29 Jul 2013 05:01:00 -0700

Viber’s Apple App store is again under cyber attack of Syrian Electronic Army. It is time to rethink for cyber world because hackers are in mood to debase credibility of cyber world. If we see in the past two weeks, we have seen many hackers debasing giant companies’ account and their development center like Instagram account, Apple’s Dev Center, and famous Viber app.

Viber is a cross platform VOIP (voice over internet protocol) was established for iPhone in Dec 2010. Viber features text, image, and video messaging around all platforms like iPhone, Android and Microsoft’s Windows Phone. At present Viber holds 30 languages and is now compatible with window and Apple PC.

Moreover, Viber is the latest example of such a malicious action performed by Syrian Electronic Army that attacked on Viber’s Apple App Store account by changing the description of Viber’s IOS app.

"We created this app to spy on you, Please Download IT”

According to 9to5Mac report hackers have taken responsibility of this attack and tried to reach to Viber authority for further clarification. Last week we noticed the attack on Viber done by the same authority called Syrian Electronic Army. It is assumed that hackers have also access to other developing functions that is indeed a serious issue for company and its customers as well. 9to5Mac’s Mark Gurman proposes the hackers could have reached access to Viber’s iTunes Connect account by a phishing fraud.

Viber authority persons gave statement in previous attack that no sensitive data was exposed and only two systems: a customer support panel and a support administration system were under attack. Below are two images of Viber spokesperson’s statement.

The two statements clearly states that the two statements are differed it seems Viber is not showing transparency to its customers. Viber was hacked on 23 July 2013 by Syrian Electronic Army intimated users to stay away from Viber. Viber has 200 million users globally.

We are facing duos situation in this cyber world as we see technology development and on other side emerging threat of hackers. A common person who relies on technology cannot understand the technical language of hackers instead rely on companies’ products by putting complete trust. Therefore, it clearly states that it is time to wake up from dream that no one seems to be secure in this unpredictable technology world, it is an alarm for the whole cyber world as you could be the next target of these culprits.

Syrian Electronic Army attacked Viber - A free calling software

nills04@gmail.com (Nill Smith) — Wed, 24 Jul 2013 07:02:00 -0700

Viber is a free call and messaging service used for Apple and Android Platform suffered from Syrian Electronic Army’s hacking attack, yesterday on 23 July 2013 Syrian Electronic Army hacked support page and left the page with message that is shown in the below image.

Viber is a cross platform VOIP (voice over internet protocol) was launched for iPhone in Dec 2010. Viber involves text, image, and video messaging throughout all platforms iPhone, Android and Microsoft’s Windows Phone. It currently supports 30 languages and now available on window and Apple PC. Even hackers also disclosed some phone numbers, email addresses of Viber admin department and told that they have captured and downloaded some part of data backups. Viber support page now appears like this.

Hackers also said that they still possess control over the system and have deleted the page “https://wa.viber.com/csrapp/home.html”used for account management and hosted on address. Hackers have provided a screenshot that reveals phone numbers, UDID, IP address and registration details. It is really a serious damage caused to Viber. If we see the defaced webpage, all the numbers carry dialing code 963 that is of Syria.

Hackers also tweeted on Twitter “http://support.viber.com#SEA #SyrianElectronicArmy" that if you have Viber we advise you to uninstall it. Still there is no confirmation of this attack has been received from Viber’s authority persons, though Syrian Electronic Army has accepted the responsibility of this attack. Viber has more than 200 million users.

The news of Viber came out after Tango’s news revealed. Tango is also a messaging App whose data cybercriminals stole. It is guessed that attackers made some phishing page pretended to be Viber and succeed to get the username and password of admin staff then they able to use this information in hacking Viber. Viber said in report, the system breached was our CSR, used to help clients for any technical issues, the data stolen was basic, and they are working on it, and promising our clients that this will not happen again in future.

Syrian Electronic Army was previously succeeded in stealing data of True Caller and Tango app websites and deleted an article published in Daily Dot website and warned Daily Dot that if they publish any article in future, they will delete the whole website.

Cyber attacks are evolving day by day and have not even left giant social media and search engines; it causes serious concern over user’s data. It affects the credibility of a company. Phishing, man in middle attack, certificate breach, DDoS attacks are some recent attacks that have affected cyber world and forced giant corporate and social media to think over these attacks. It is a sure question arises in our mind “Do we live in hacker’s world or else hackers live in our world”.

Some sort of cyber policies should be there to fight against such hackers otherwise; the days are not far, where people avoid dealing with internet and social media.

Symantec: SMBs gets benefits through Strategic IT

nills04@gmail.com (Nill Smith) — Tue, 25 Jun 2013 05:22:00 -0700

This info-graphics discloses about the Global SMB IT Confidence Index that was carried by ReRez in Feb-march 2013. Symantec declared this report which demonstrates the ratio of IT implementation and security prospective in top-tier and bottom-tier SMBs (Small and medium businesses).

The survey shows the attempts of SMB in matching the progressively technology-centric business world. The findings are as under. They reviewed 2452 SMBs across 20 countries includes Americas, Western Europe/the Middle East and the Asia Pacific region including 10 to 250 employees who are conducting company’s technology management. The reliability of this survey is about 95% with a 5% marginal difference.

Get SSL Certificate at lowest price from ClickSSL.com

Protect your Organizations against Online Attacks

nills04@gmail.com (Nill Smith) — Mon, 29 Apr 2013 10:24:00 -0700

To get protection against online attacks and vulnerabilities online merchants must have SSL (secure socket layer) security, which is in interest of business and customers. Different types of attackers (serious hackers, computer beginners, or dissatisfied current or former employee) could induce a possible threat into organization’s information security. Many attackers take advantage of poor policy and procedure related to information security. Today with the help of internet, anyone can find the information regarding how to manipulate the system by exploiting security weakness on your online business. Attackers may also break security by applying automated tools to look into network systems, and exploits any known security weaknesses to get illegal access to the network.

Attacks and Threat Trend: Symantec has published “Threat Trend report 2013” in which some shocking facts have come out which is worth thinking for online industries. The facts are as below:

The average number of malicious website-blocked ratio is increased by 30% in 2012. There were 247,350 websites were in the list of blocked website in 2012 compared to 190370 websites in second half of 2011.
The number of malicious blocks ratio was 37% higher than its annual average.
The most exploited website categories and (percentage) of infected website are as below.

There are 7.7% websites were malicious was assorted in blogging category.
43% compromised religion websites were infected with fraud antivirus attacks.
28% compromised business sites were infected with fake antivirus attack.

What is Online Attack: Attack is a term where attacker plays role of a genuine verifier and changes the authentication channel to access the network authentication. There are different types of network attacks, which can bring disasters in network system.

We would like to share the latest security attacks and steps to protect your online business from such attacks.

Backdoor Attack:

Back door also called trap door. It is a part of program code, which is written into application without the awareness of the users and the administrator. It allows fast access to programmers to make easy debugging or monitoring the program. Backdoors typically allow programmers to make use of the software or hardware with the most important rights such as root or administrator. When programmer neglects to remove backdoor after debugging then, a backdoor becomes a serious trouble. Backdoors work mutely in the background and are tough to find out.

Steps against Backdoor: There are some tips to save your system against backdoor attacks.

You can run antivirus to close the backdoor attacks.
Turn your firewall protection to get alert of any backdoor attack.
Regular checks the entire program integrity.
Make rigorous control process and system development.

Brute Force:

Brute Force attack is used against encrypted data then using software to crack the code and gain right to use of USER ID and password. With user ID attacker gains access of privileges and can generate a backdoor for future approach. Brute-force attack includes tries multiple key combination to discover the right password that will unlock the encryption. The higher the encryption is the longer it will take time.

Steps against Backdoor: There are some tips to save your system against backdoor attacks.

Use strong encryption technology and effectual key management technology to protect User ID, password.
Periodically change your password
Run penetration testing to discover vulnerability.
Give enough education to customers and employees on security precautions.

Denial of Service(DOS):

Denial of Service is a disrupting attack which do not target network access but disturb the network traffic flow by injecting more information on the server than it can control. This kind of attack can be generated at single or multiple sources. Dos attack makes web resources unavailable for common users by flooding the URL with numerous requests.

Steps against DOS: Some tips which can help you to prevent DOS attack and save your system.

Tell Internet service provider to arrange traffic from authorized sources only.
Arrange sufficient backup and recovery arrangements.
Perform penetration testing for assessing the network ability.

In recent time, DDOS attack brings down the internet speed with enormous unnecessary request flaws or dummy traffic. DDOS attack was targeted at Spamhaus, a spam filter company that maintains filters email spammers. The DNS requests used in this attack was 300Gbps.

Hijacking Attack:

It is a network security attack that allows attacker to take control of an established connection during its running process. Hijacking attacks generally happen on a remote computer like personal computer. The attacker intercepts the message in a public key exchange and replaces his own public key for the requested message. Therefore, two original parties will appear for communication with each other like server to the client and the client to the server. Thus, attacker seems to be legitimate connection can interpret the message during the transmission.

Steps against Hijacking: Below are steps that can be put into practice for the system to save from hijacking.

Apply strong authentication methods like implementation of SSL security for sending sensitive data.
Apply firewall setting wherever it fits.
Monitor network traffic and use scanning tools.
Implement enough network security.
Get more.

Sniffers Attack:

Sniffer attack catches network packets it is also called network protocol analyzers that is also applied by hackers for hacking network. Hackers can capture network traffic if it is not encrypted. Once the packet is taken over then attacker can read the message of that particular packet. The message contains passwords, account information, or other confidential information, etc.

Steps against Sniffers: Below are steps that can be placed into practice for the system to save from sniffer attack.

Apply strong SSL security for sensitive sessions.
Regularly monitor network traffic and use scanning tools.
Apply enough network security.
Provide guidance to customers and employees about security precautions.

Spoofing Attack:

Spoofing attack means to do trick or betray network system. Spoofing allow attackers to hide their identity or communicate with a fake identity which pretend to be a legal identity. Therefore, network recognizes the unauthorized network as an authorized network. Attacker can easily gain access the sensitive data. Spoofing can be done through email spoofing, IP spoofing, fake identity.

Steps against Spoofing: Spoofing is a simple way to make others victim by making a fake username. To prevent from it user can take following steps.

Apply firewall setting wherever it fits.
Apply strong SSL security for sensitive sessions.
Regularly monitor network traffic and use scanning tools.

Man in the Middle Attack:

Man in the middle (MITM) attack also refers to bucket brigade attack in this case attacker sniffs the information transferring between the sender and the receiver like the server and the browser or between two servers. Such information is not encrypted. Attacker collects the information and intercepts it then sends it to the receiver.

Steps against MITM: Following are some useful steps to avoid MITM attack.

Download the latest version of high security web browsers.
Use Extended Validation (EV) certificate for the highest protection against MITM attack.
Use two-factor authentication for sensitive accounts.
Never respond unknown or spam emails.

Phishing Attack:

In Phishing attack, attacker personates to be a legal person or business through fraud emails or websites and illegally acquire sensitive information like username, passwords, credit card information, and bank account details. There should be SSL security (EV certificate) that can provide protection against phishing. Besides, user training and technical measures also need to be implemented.

From the above discussion about different online attacks, we can definitely understand that how much essential the SSL is not only from preventing online threats but also helps gain fame and trust from the visitors. It is therefore required to have a strong security called SSL protocol for your online business.

SSL - Secure bridge of Online information:

Now we can imagine that how online attacks have influenced online industries. In this situation, SSL (secure socket layer) can secure your entire website with robust security. SSL is an encrypted technology, enabling the server and the browser to transfer the information in a secure environment. SSL encrypts the information so the hacker could not identify it and user information will remain secure over the web. SSL uses public key and private key to encrypt and decrypt the information.

How SSL Works?: What comes out when a Web browser connects to an SSL secured Website?

The first step is that the browser attempts to connect to the website.
The browser demands the Web server to confirm whether the web site is equipped with SSL security or not.
The server of the site transmits a copy of the SSL certificate for the visitor's web browser confirmation.
The next step is confirmation of the SSL security certificate.
The browser assures that the certificate sent by the SSL web server is trustworthy.
If the certificate is legitimate, the browser transmits a message to the web server.
However, if it fails, the browser makes a warning and stimulates the user to authorize or deny the legitimacy of the web server certificate.

At the end, we can summaries that online attacks are expanding their horizon and it is sensible to have a strong network security to prevent online attacks. In this case, SSL stands alone in security criteria that have utmost protection for described online attacks. It allows a secure bridge in which the sender and the receiver can transmit data in a secure environment.

9 Reasons to Choose ClickSSL

nills04@gmail.com (Nill Smith) — Fri, 30 Sep 2011 02:28:00 -0700

1. Important of Consumer Convenience

ClickSSL provides quick and easy to obtain an SSL certificates. Before consumers enter credit card or sensitive personal information online they want to confirm that they are on the intended site and that their information is protected. Our SSL Certificates are trusted and secure. We help you protect sensitive information during transmission when your customers, business partners, and employees connect with you online.

2. Best Products – Lowest Price : Price Match Guarantee

Our SSL Certificates prices are cheap but products are best in SSL Industries. Our SSL Certificate supports 99+ % of all browsers and most mobile browsers and enable up to 256-bit encryption. We proudly guarantee the lowest pricing of all our brand SSL certificates. We always want you buy and renew SSL Certificates from us only. We guarantee lowest pricing and clock around quality support services what make us choice of smart buyers like you

3. One Stop Solution for Renew SSL Certificates

We offer you to renew your existing SSL Certificate at the lowest price in the market place. This would help securing your website online transactions at low price. We will bring continuity of cost effective internet security solutions to you. We offer an exclusive discount of Renew SSL Certificates. It makes renewal very easy and fast. You can get many benefits when you renew your SSL Certificate from the site. You will get 90 days extra validity on regular renewals or earlier renewals. You can also get special discounts for multiyear renewals from this site. This is about to give more discount to the customer and make them safe from internet fraud.

4. Get Free "SSL Secured Site Seal"

The “secured site seal” helps to establish your online authenticity by showing your visitors that your site has verified by most trusted Certificate Authorities on the Internet. When visitors to your web site see the “secured site seal”, they feel more confident to complete their online business and you will notice a marked reduction in abandonment rates and boost your online business.

5. Delivered by Leading Certificate Authorities

ClickSSL is Platinum Partner Company of RapidSSL, Thawte, GeoTust and VeriSign. We authorized to resell and renew all SSL Certificates. We offers highly secured and widely trusted SSL certificates at lowest price to support ecommerce security.

6. Broad range of online security products

ClickSSL has broad range of SSL products like Domain Validation SSL, Business Validation SSL, Wildcard SSL, EV SSL, SAN SSL, SGC- enable SSL Certificate and Code Signing Certificates.

7. 24x7 technical and sales supports
When you need help to setting up, managing and renewing your SSL Certificate. Our security experts give you easy and straightforward solution. Our professional administrator always analyses on ecommerce security. ClickSSL has helps companies and organizations of every size around the globe secure their e-commerce and Internet communications. A leader in Internet security solutions, ClickSSL offers affordable SSL Certificates, 24 x 7 support and advanced e-commerce products that are easy to use.
8. Get FREE Warranty
We importance our consumers, so we have guaranteed to offer SSL Certificates that include a warranty in the happening an SSL Certificate is mis-issued. The warranties range from $5,000 to $1,500,000 on all of our SSL Certificates, correct warranty information offered by all Certificate Authorities is available here.
9. Money-back guarantee
Our main goal is provide excellent consumers service, here at we are looking for completely clients satisfaction. We offer 100% refund of order amount on any SSL certificate purchase up on order cancellation request. If you are not satisfied, you can easily get your money back without any question.

SGC SSL Certificate: Enabling Strong Encryption for the Most Site Visitors

nills04@gmail.com (Nill Smith) — Tue, 27 Sep 2011 06:38:00 -0700

If your reputation in the online community depends upon the stringent safeguarding of information processed through your Web site, then your Internet security solution should include the strongest encryption available to each Web site visitor.

Encryption is the process whereby data is transformed into a code that will be indecipherable to an unauthorized viewer. The stronger the encryption, the more difficult it is for someone to eavesdrop on your online communications. This is especially important if you accept any kind of online payments, connect to a bank or brokerage account, transmit health records, must meet a governmental or other regulatory organization’s privacy and security standards, or process any kind of potentially sensitive information.

Industry experts recommend a minimum of 128-bit encryption be used for all secure online sessions. Some Web server-client browser configurations enable sessions with up to 256-bit encryption protection, the strongest level of encryption commercially available today.

The strength of encryption enabled for any session depends on what your customer’s browser and operating system support, as well as what your host server systems will support. If your consumer’s browser or operating system does not support higher levels of encryption, the session will default down to the highest level that it can support.

Regular 128-256 bit SSL Certificates intended for securing leading sites over usual browsers, where SGC SSL Certificates upgrade the encryption capabilities of older browsers from 40-bit encryption into full 128- or 256-bit encryption.

Server Gated Cryptography (SGC) enabled SSL Certificates upgrade the encryption capabilities of older browsers from 40-bit encryption into full 128/256 bit encryption – ensuring your website protects and is trusted by the highest number of internet users possible.

With SGC SSL Certificate, encryption levels are controlled by the server and not dependent on the client system. Once these original export restrictions were lifted, SGC-enabled SSL Certificates are now issued to all types of Web sites, not just authorized financial institutions.

VeriSign offers market-leading SGC-enabled SSL Certificates so virtually every visitor to your Web site will be protected by the industry recommended minimum of 128-bit encryption.

Installation Guideline: SSL Certificates on Tomcat Server

nills04@gmail.com (Nill Smith) — Sun, 24 Apr 2011 23:13:00 -0700

SSL – Secure Socket Layer is a security Protocol. SSL Certificate is a digital signature. SSL Certificate is also known as Public Key Identity certificate. SSL is a protocol for securing communication between a web browser, and web server. Whenever you access a web server using https, the page you are sent is encrypted, and any information you send to that server is also encrypted

Install Root CA Certificate

1) Download your SSL Certificates from SSL Certificate Authorities like RapidSSL, Thawte, GeoTrust or VeriSign.
2) Use the Primary and Secondary Intermediate CA contents into a text file. (Use a text editor - Notepad or Vi.)
3) Primary Intermediate CA (file name as primary_inter.cer)
4) Use the below control to import this Certificate in the keystore:

keytool -import -trustcacerts -alias primaryIntermediate -keystore (your_keystore_filename) -file primary_inter.cer

5) For the Secondary Intermediate CA, (file name as secondary_inter.cer)
6) Use the below control to import this Certificate in the keystore:

keytool -import -trustcacerts -alias primaryIntermediate -keystore (your_keystore_filename) -file primary_inter.cer

Install the SSL Certificate

SSL CA email your Certificate. Use an attachment file(Cert.cer). Copy and paste it into a text file.
Use the below control to import your SSL Certificate:

keytool -import -alias -keystore (your_keystore_filename) -trustcacerts -file (your_certificate_filename)

configure the SSL in Tomcat with server.xml

1) Close the Tomcat Server, when it is running. While it is started, Changes to the file /conf/server.xml are read by Tomcat Server.
2) Open the file < NPJBMK _HOME>/conf/server.xml in a text editor.
3) Detect the following section of code in the file. Remove comment tags around the Connector entry. The comment tags that are to be removed are shown below.

4) Save and restart Tomcat server

About ClickSSL:

ClickSSL.com is SSL Certificates Reseller and the platinum partner of Leading Certificates Authorities such as VeriSign, GeoTrust, Thawte and RapidSSL. Buy or Renew Wildcard SSL, EV SSL, Multi-Domain SSL Certificates and many more from ClickSSL at Cheapest Prices in the Industry.

Why ClickSSL? We offer internet business owners to buy or renew SSL Certificates for their internet based business at very low cost. Why We Sell Cheap SSL Certificates? We buy bunch SSL Certificates from leading authorities and pass discounts to internet business owners. For more information visit ClickSSL.com

SSL - Single Root Vs Chained Root

nills04@gmail.com (Nill Smith) — Mon, 21 Jun 2010 02:01:00 -0700

SSL certificates are basically two types.

Single Root Level SSL Certificate
Chain Root SSL Certificate

When connecting to a web server over SSL, the visitor's browser decides whether or not to trust the website's SSL certificate based on which SSL Certification Authority has issued the SSL certificate. To determine this, the browser looks at its list of trusted issuing authorities - represented by a collection of Trusted Root CA certificates added into the browser by the browser vendor (such as Microsoft, Linux, UNIX, Sun and Netscape, Mozilla, Safari).

Where is this list of CA in your computer?

When browsers and operating systems are developed / installed, most CA Root certificates will be installed. As all Root CA are required to authenticate SSL certificate on any website. When you browse any website on HTTPS://, browser will automatically identify Root Certificate as defined earlier. If browser fails to identify CS then there would be an error message.

Most SSL certificates are issued by CAs who own and use their own Trusted Root CA certificates, such as those issued by VeriSign, RapidSSL, Thawte, and GeoTrust. As all of these are known to browser vendors as a trusted issuing authority, its Trusted Root CA certificate has already been added to all popular browsers like Internet Explore (IE 4.0, 5.0, 6.0, 7.0, 8.0), Mozilla Firefox, Safari, Netscape and hence is already trusted. These SSL certificates are known as "single root" SSL certificates. RapidSSL and GeoTrust own the Equifax root used to issue its certificates. As well VeriSign and Thawte have own Root to issue SSL certificates.

What is Chained Root SSL Certificate?

Some Certification Authorities do not have a Trusted Root CA certificate present in browsers, or do not use the root they do own. In place they use a "chained root" in order for their SSL certificates to be trusted - essentially a CA with a Trusted Root CA certificate issues a "chained" certificate which "inherits" the browser recognition of the Trusted Root CA. These SSL certificates are known as "chained root" SSL certificates. However chained root certificates installation is more complex and some web servers and applications are not compatible with chained root certificates. Chained root certificates require additional effort to install as the web server must also have the chained root installed. This is not necessary for single root certificates.

For a Certification Authority to have and use its own Trusted Root CA certificate already present in browsers is a clear sign that they are long-time, stable and credible organizations who have long term relationships with the browser for the inclusion of their Trusted Root CA certificates. For this reason, such CAs are seen as being considerably more credible and stable than chained root certificate providers who do not have a direct relationship with the browser vendors, or do not use their own root certificates to issue SSL certificates.

ClickSSL.com provides only Single Root SSL Certificates.

What is ClickSSL Reseller Program?

nills04@gmail.com (Nill Smith) — Thu, 6 Aug 2009 12:19:00 -0700

What is CLICKSSL Reseller Program?

CLICKSSL Reseller program is specially developed for online SSL certificate reselling.

Is this Reseller Program Free?

Yes - ClickSSL offers FREE reseller program.
Reseller account and API - 100% FREE.
No upfront payments. Only Pay As you Buy.

What are Reseller account benefits?

Reseller Account is FREE!
Reseller will be offered discounted price than regular price.

Who can register for SSL reseller program?

Companies who having business domain in SSL certificate selling, website hosting, website development, website designing, domain registration provider and all type of IT services.

My business does not belong from any of above domain; shall I enroll for Reseller Account?

Yes – You can enroll for FREE SSL Reseller Account. You will get $0 set up reseller account.

Introduction to SSL

nills04@gmail.com (Nill Smith) — Thu, 16 Jul 2009 07:26:00 -0700

Certificate Authority (CA)

— A Certificate Authority is a trusted third-party organization that issues digital certificates such as Secure Sockets Layer (SSL) Certificates after verifying the information included in the Certificates.

Encryption

— Encryption is the process of scrambling a message so that only the intended audience has access to the information. Secure Sockets Layer (SSL) technology establishes a private communication channel where data can be encrypted during online transmission, protecting sensitive information from electronic eavesdropping.

Extended Validation (EV) SSL Certificate

— Requires a high standard for verification of Secure Sockets (SSL) Certificates dictated by a third party, the CA/Browser Forum. In Microsoft® Internet Explorer 7 and other popular high security browsers, Web sites secured with Extended Validation SSL Certificates cause the URL address bar to turn green.

HTTPS

— Web pages beginning with "https" instead of "http" enable secure information transmission via the protocol for secure http. “Https” is one measure of security to look for when sending or sharing confidential information such as credit card numbers, private data records, or business partner data.

Secure Sockets Layer (SSL) Technology

— SSL and its successor, transport layer security (TLS), use cryptography to provide security for online transactions. SSL uses two keys to encrypt and decrypt data − a public key known to everyone and a private or secret key known only to the recipient of the message.

SSL Certificate

— A Secure Sockets Layer (SSL) Certificate incorporates a digital signature to bind together a public key with an identity. SSL Certificates enable encryption of sensitive information during online transactions, and in the case of organizationally validated Certificates, also serve as an attestation of the Certificate owner’s identity.

Secure Sockets Layer (SSL) Certificate is the World Standard for Web Security. SSL technology confronts the potential problems of unauthorized viewing of confidential information, data manipulation, data hijacking, phishing, and other insidious Web site scams by encrypting sensitive data so that only authorized recipients can read it. In addition to preventing tampering with sensitive information, SSL helps provide your Web site’s users with the assurance of having accessed a valid Web site. Support for SSL is built into all major operating systems, Web applications, and server hardware—meaning that SSL’s powerful encryption technology helps provide your business with a system-wide, liability limiting security blanket for fortifying consumer confidence, boosting the percentage of completed transactions, and enriching the “bottom line.”

What is SSL and why should I care?

nills04@gmail.com (Nill Smith) — Thu, 16 Jul 2009 05:58:00 -0700

Data security over open communication networks such as the Internet will always be a strong concern for developers and customers. Therefore, it is extremely important for a any product you use to be able to achieve a secure environment.

What is SSL?

SSL is a protocol that provides privacy and integrity between two communicating applications using TCP/IP. The data going back and forth between client and server is encrypted using a symmetric algorithm.

A public-key algorithm (RSA) is used for the exchange of the encryption keys and for digital signatures. Public key cryptography defines an algorithm that uses two keys, each of which may be used to encrypt a message. If one key is used to encrypt a message, the other must be used to decrypt it. This makes it possible to receive secure messages by simply publishing one key (the public key) and keeping the other undisclosed (the private key).

Digital certificates

This takes us into the discussion of digital certificates, which play an important role in SSL Certificates. Digital certificates mainly serve two purposes:

To establish the owner's identity
To make the owner's public key available
A digital certificate is issued by a trusted authority -- a certificate authority (CA) -- and it is issued only for a limited time. When its expiration date passes, the digital certificate must be replaced. SSL uses digital certificates for key exchange, server authentication, and optionally, client authentication.
The digital certificate contains specific pieces of information about the identity of the certificate owner and about the certificate authority:
The owner's distinguished name.
The owner's public key.
The date the digital certificate was issued.
The date the digital certificate expires.
The issuer's distinguished name. This is the distinguished name of the CA.
The issuer's digital signature.
An SSL connection is always initiated by the client using a URL starting with https:// instead of http://.

VeriSign Extended Validation Certificate

nills04@gmail.com (Nill Smith) — Sun, 21 Jun 2009 02:54:00 -0700

Extended Validation Certificates (EV) are a special type of X.509 certificate which requires more extensive investigation of the requesting entity by the VeriSign, Thawte, GoTrust before being issued.

The criteria for issuing EV certificates are defined by the Guidelines for Extended Validation Certificates, currently at version 1.1. The guidelinesare produced by the CA/Browser Forum, a voluntary organization whose members include leading CAs and vendors of Internet software, as well as representatives from the legal and audit professions

An important motivation for using digital certificates with SSL was to add trust to online transactions by requiring website operators to undergo vetting with a certificate authority (CA) in order to get an SSL certificate. However, commercial pressures have led some CAs to introduce "domain validation only" SSL certificates for which minimal verification is performed of the details in the certificate.

Most browsers' user interfaces did not clearly differentiate between low-validation certificates and those that have undergone more rigorous vetting. Since any successful SSL connection causes the padlock icon to appear, users are not likely to be aware of whether the website owner has been validated or not. As a result, fraudsters (including phishing websites) have started to use SSL to add credibility to their websites.

By establishing stricter issuing criteria and requiring consistent application of those criteria by all participating CAs, EV SSL certificates are intended to restore confidence among users that a website operator is a legally established business or organization with a verifiable identity.

EV SSL Certificate issuing criteria

Only CAs who passes an independent audit as part of their Web Trust (or equivalent) review may offer EV, and all CAs globally must follow the same detailed issuance requirements which aim to:

Establish the legal identity as well as the operational and physical presence of website owner;
Establish that the applicant is the domain name owner or has exclusive control over the domain name; and

Confirm the identity and authority of the individuals acting for the website owner, and that documents pertaining to legal obligations are signed by an authorized officer.

VeriSign EV SSL Certificate at User interface

Browsers with EV support display more information for EV certificates than for previous SSL certificates. Microsoft Internet Explorer 7, Mozilla Firefox 3, Safari 3.2, Opera 9.5, and Google Chrome all provide EV support.

The Extended Validation (EV) guidelines require participating Certificate Authorities to assign a specific EV identifier, which is registered with the browser vendors who support EV once the Certificate Authority has completed an independent audit and met other criteria. The browser matches the EV identifier in the SSL certificate with the one it has registered for the CA in question: if they match, and the certificate is verified as current, the SSL certificate receives the enhanced EV display in the browser's user interface.

VeriSign Extended Validation certificate identification

EV certificates are standard x.509 digital certificates. The primary way to identify an EV certificate is by referencing the Certificate Policies extension field. Each issuer uses a different object identifier (OID) in this field to identify their EV certificates, and each OID is documented in the issuer's Certification Practice Statement.

What is Extended Validation's effect on phishing?

In 2006, Stanford University students conducted a usability study of the EV display in Internet Explorer 7. The study attempted to measure users' ability to distinguish real sites from fraudulent sites when presented with various kinds of phishing attacks.

Due to the small size of the study's sample base (nine test subjects per cell) the margin for error of each result was several times the actual measurement, and therefore no useful conclusion was possible. However, this study led the way for other researchers to present results of a statistically significant nature. In January 2007, usability research firm Tec-Ed published its results of running 384 North American test subjects through purchasing simulations on sites with and without green address bars.

Tec-Ed concluded that latent understanding of green address bars was very high, with 93% of test subjects recognizing a site with a green address bar as a safer shopping experience than one without. With regard to Extended Validation's defense against phishing, the Tec-Ed research reveals that when a site adopts green address bars, then 77% of users visiting what appears to be the same site but without the green address bar will decline to complete the transaction. Apparently, though, these results followed some training, so it is difficult to infer what untrained users would do.

To get VeriSign EV Certificate at lowest price visit: https://www.clickssl.com

More about RapidSSL Certificate

nills04@gmail.com (Nill Smith) — Sun, 21 Jun 2009 02:17:00 -0700

As you know RapidSSL is largest SSL Certificate seller in the world. As a CA (Certificate Authority) RapidSSL strongly follow industry standard in SSL issuance and validation process.

What validation processes does RapidSSL use?

Trust hierarchy demands that entities "vouch" for each other. Companies that issue SSL certificates are in the business of establishing that entities on the web are, in fact, who they claim to be. The potential for criminal activity on the web (in relevance to SSL anyway), is in online ‘hijacking’ of sites or connections to siphon encrypted data. Persons so inclined can easily "copy" web site interfaces and pose as well known vendors, simply to collect these data.

SSL certificates work to prevent this through ensuring that www.abc.com is, in fact, ABC Co. In the “real world”, RapidSSL use identification procedures like photo ids, telephone calls and papers of incorporation to know with whom we’re dealing. If products or services are defective, buyers can seek recourse. In the “online world”, companies wishing to use SSL certificates must prove to the certificate authority that they have the right to present themselves online as ABC Co.

This is done through a variety of means in different SSL products. For simplicity’s sake, consider the method started and championed by Verisign, as the ‘traditional’ model. The process involves certificate petitioners faxing in their articles of incorporation, and then waiting several days to be granted a certificate to do business online under that name. There is a fair amount of overhead related to this task, as these credentials are examined and reviewed, and full-service products in this arena can cost hundreds of dollars.

There are newer, lower-cost alternatives in which certificates are issued more quickly. These SSL certificates verify that the certificate holder is the owner of that domain, ensuring customers that URL “owners” are who they claim to be.

Is self sign SSL safe or not?

nills04@gmail.com (Nill Smith) — Thu, 18 Jun 2009 09:07:00 -0700

There are two types of SSL certificates on basis on issuance type.

Self signed SSL certificates

Self-signed certificate is an identity certificate that is signed by its own creator. That is, the person that created the certificate also signed off on its legitimacy.

CA issued SSL certificates

A CA issues digital certificates that contain a public key and the identity of the owner. The matching private key is not similarly made available publicly, but kept secret by the end user who generated the key pair. The SSL certificate is also an attestation by the CA that the public key contained in the certificate belongs to the person, organization, server or other entity noted in the certificate. A CA's obligation in such schemes is to verify an applicant's credentials, so that users and relying parties can trust the information in the CA's certificates. CAs use a variety of standards and tests to do so.

A CA issues digital certificates that contain a public key and the identity of the owner. The matching private key is not similarly made available publicly, but kept secret by the end user who generated the key pair. The certificate is also an attestation by the CA that the public key contained in the certificate belongs to the person, organization, server or other entity noted in the certificate. A CA's obligation in such schemes is to verify an applicant's credentials, so that users and relying parties can trust the information in the CA's certificates. CAs uses a variety of standards and tests to do so.

It the user trusts the CA and can verify the CA's signature, then he can also verify that a certain public key does indeed belong to whomever is identified in the certificate.

Now let’s talk about Self Signed SSL Certificate. Self signed SSL is created by individual to install on intranet / internet website. If your website is installed with self signed SSL certificate and any one browse website on secure channel HTTPS:// then he/she will get error (Error: Security Failed. Invalid Certificate Found).

What this error means? (Error: Security Failed. Invalid Certificate Found).

Well you have installed self signed SSL certificate so it is trusted by your own server/pc only. SSL certificates are always authenticated by Root CA certificates. Self signed SSL does not have Global Root CA certificate as it is created on your in-house server and user PC is not installed with that Root CA certificate. So whenever anyone will browse your website on secure channel HTTPS://, SSL certificate installed on website will not be authenticated as a trusted SSL certificate and there will be SSL certificate Security error. Visitor will see error and will jump out from your website as he/she feels unsecure providing confidential details like Credit Card Number, Security Code, User name, Password, etc.

If you want to work Self signed SSL certificate then you need to install Root SSL Certificate central CA on each user PC. If you are on intranet and you have to install it in few PCs then it is possible. What about PC on internet? How can you install on website visitor PC, before he visit your website? This is not possible at all as you can not guess who will visit your website and what time he will visit your website?

For example read this.

In a web of trust certificate scheme there is no central CA, and so identity certificates for each user can be self-signed. In this case, however, it is additional signatures from other users which are evaluated to determine whether a certificate should be accepted as correct. So, if users A, B, and C have signed Mary’s certificate, user E may decide to trust that the public key in the certificate is Mary's (all these worthies having agreed by their signatures on that claim). But, if only user A has signed, E might (based on his knowledge of A) decide to take additional steps in evaluating Alice's certificate. On the other hand, C's signature alone on the certificate may by itself be enough for E to trust that he has Alice's public key (C being known to E to be a reliably careful and trustworthy person).

There is of course, a potentially difficult regression here, as how can E know that A, B, Ted, or C have signed any certificate at all unless he knows their public keys (which of course came to him in some sort of certificate)? In the case of a small group of users who know one another in advance and can meet in person (e.g., a family), users can sign one another's certificates when they meet as a group, but this solution does not scale to larger settings. This problem is solved by fiat in X.509 PKI schemes as one believes (i.e., trusts) the root certificate by definition. The problem of trusting certificates is real in both approaches, but less easily lost track of by users in a Web of Trust scheme.

Credit: http://en.wikipedia.org/wiki/Self-signed_certificate

SSL Security Site Seal

nills04@gmail.com (Nill Smith) — Tue, 16 Jun 2009 10:19:00 -0700

ClickSSL.com provides a free Secure Site Seal to all SSL Certificate Customers, which helps them to educate web visitors on the security technology they employ to protect against phishing attacks and eavesdropping. Security Site Seal clearly shows that the transactions performed on the website are securely encrypted by strongest SSL technology. When visitor click on SSL site seal, it displays website security information. If you have installed true value SSL (Organization Verified SSL Certificate) then you can show True Site Seal.

This shows organizations details such as domain name, business name, address and etc. This way you can give your website visitors visible, real-time assurance that the website is authentic and protected.

Visitors like only user friendly and visible things to see on website. Now if you have installed SSL certificate on website and you do not display SSL Security Site Seal then some visitors may jump out from your website. SSL Security Site is a brand image, especially for online shopping cart websites.

You should be aware of SSL Security Site Seal use and misuse. Following are few assistance on misuse of SSL Security Site Seal.

Who should display SSL Security Site Seal on website?

1. If you have installed verified SSL Certificate on your website, then only you can use SSL Security Site Seal.

Who should not display SSL Security Site Seal on website?

1. If your website is not installed SSL Certificate and you display SSL Site seal then it is SCAM.

2. If you have purchased SSL Certificate but did not install on website and you display Site Seal then it is SCAM.

3. If you have already installed SSL certificate but SSL certificate validity is expired and you display SSL Security site seal then it is SCAM.

4. If you have SSL purchased for one of your company website and you display SSL Security Site Seal on all company website, then it is SCAM.

5. You can display SSL Security Site Seal on SSL Certificate installed website.

Warning:

SSL Security Site Seal misuse is SCAM and anyone (SSL Provider /Reseller / Issuer / Customer / Visitor) can claim for this SCAM. As they can believe that either you store personal information like Credit Card number and security code, username, password, credential information.

For more information on the new site seal service, please visit: ClickSSL.com

About ClickSSL.com

ClickSSL is Platinum Reseller of VeriSign. VeriSign is leading SSL Provider company is website security. ClickSSL.com offers publicly trusted SSL, including EV SSL Certificates, Code Signing Certificates for use on all platforms including mobile devices. Its Trusted Root solution uses the widely distributed Equifax and VeriSign Root CA certificates to provide immediate PKI trust for Microsoft CA and enterprise CAs, eliminating the costs associated with using trusted Root Certificates. ClickSSL also provides SSL Certificate for email security.

Are you shopping online using credit card?

nills04@gmail.com (Nill Smith) — Mon, 15 Jun 2009 11:33:00 -0700

Hey, are you shopping online using credit card? Wait first read this before you provide your credit card detail on any website.

Hi, I am Jay from CLICKSSL. I would like to share some security facts about your website, email risks.

How any one can hack information from website?

Hackers are always there on internet to steal your credit card numbers, email passwords and credential information. When you start paying on website you enter your credit card number and secret code on website. This information will go on internet. Now if the information does not pass on secure way then hacker will hijack your credit card. To know more visit: ClickSSL.com

How can I know that website is secured or not?

Well, it is so simple to identify secure website. Website should work on HTTPS:// protocol. For example: https://www.clickssl.com. SSL Certificate is only a security solution that can provide secure way to transfer data over internet.

How SSL Secures data?

SSL Certificate use Data encryption and decryption technology for data transmission. SSL use 256 bit encryption level to encrypt data. So no one can hack your information.

When you open site with HTTPS:// site should work fine without any error or warning message. Now you can see SSL Lock Icon on browser window.

What type of SSL Certificate website should have?

Below is list for SSL Providers CA (Certificate Authority).

VeriSign | GeoTrust | Thawte | RapidSSL

All of these CA are well known and trusted. VeriSign offers high value SSL Certificate as well GeoTrust EV SSL Certificates are built on high level encryption including Green Address Bar. When visitor will browse website address bar color will be changed to Green. EV SSL Certificates are high value SSL Certificates It will look like this.

However, there so many SSL types you can use for your website. Following are few recommendations:

First you have to identify that what type of website you hold.

My website is	Recommended SSL Certificate Type
E-Commerce Website : Low Volume Business	Thawte SSL123
E-Commerce Website : High Volume Business	GeoTrust True BusinessID
Intranet Website	RapidSSL
Unlimited Sub domain website(*.domainname.com)	RapidSSL Wildcard
Mail Server - Webmail	GeoTrust Quick SSL Premium
Banking and Finance Website	VeriSign EV SSL Certificate
Exchange & SharePoint Server	Thawte SSL Web Server
Website know by business brand	Green Address Bar SSL Certificate

About CLICKSSL

ClickSSL is a leading SSL Provider and reseller for VeriSign, GeoTrust, Thawte and RapidSSL. ClickSSL is a Platinum Partner of VeriSign. We offers instant issued SSL Certificates at high discount prices. You can save up to 80% of SSL Spending with us. ClickSSL offers clock around support and quick reference guide. We offer FREE Site Seal and Root CA certificates.