Whose Site is it Anyway?

Despite the rapid increase in online commerce, it is estimated that some 85% of transactions are still cancelled at the final ‘confirm and buy’ page. While some of these aborted purchases are simply down to people changing their minds, many are due to concerns about security and a reluctance to dispatch credit card details and other personal information across the unknown Internet. Maybe this is not surprising given the amount of publicity generated by new cases of Internet hacking and fraud.

People who buy things online may be familiar with the closed-lock padlock in the bottom right hand corner of their screens. While this is meant to provide a sense of security, how many Internet shoppers actually know what it refers to? In fact the padlock is there to show that at that particular time i.e. on the current web page communications with that site will be secured using encryption based on a protocol called SSL – or Secure Socket Layer (see explanation). In an ecommerce transaction, SSL achieves two things. It authenticates to the user the identity of the organisation responsible for the site in question and ensures that any information transmitted between the purchaser’s web browser and the merchant’s web site is protected from potential eavesdroppers or hackers listening in from anywhere on the Internet.

But sometimes all is not what it appears to be. ‘Spoofing’ or ‘phishing’ is the latest type of Internet fraud, where fake websites are set up that mimic well-established companies and persuade those who visit them to part with credit card details and other valuable financial information.

Many of the biggest names in the .com world have been victims, including Amazon, AOL, Ebay and PayPal as well as a number of high-street banks. In one recent case a gang of Nigerian fraudsters set up a fake version of NatWest’s online service and used it to con two Canadians out of more than Â?100,000. The website was identical to that of the real bank but had an additional ‘the’ at the beginning of the web address.

In another recent case, The US Federal Trade Commission charged an unidentified 17-year-old boy with producing a look-alike web page for AOL and conning hundreds of people out of their credit card information. The teenager produced emails that told the recipients they needed to update their AOL billing information by clicking on a link marked ‘AOL Billing Centre’.

They were then diverted to a phony website that looked identical to the real thing and instructed to enter credit card numbers, billing addresses and other details including AOL screen names and passwords.

Establishing Trust

The proof of a website’s authenticity is in its digital certificate and the security foundations of digital certificates are the ‘private’ SSL encryption keys used by the web server. If an attacker has the private key, then they can spoof a website not only with look-alike pages but also with outward proof – the digital certificate – that the impostor site is the real site. Furthermore, they will also be able to decrypt all the traffic that is going to and from that site.

Therefore a web site’s identity and the integrity of online transactions cannot be truly trusted unless the SSL private keys are kept absolutely secret. The problem is that many sites still store their cryptographic keys in the memory of their web servers. But because of the inherent very random nature of the data that makes up these keys, a quick memory scan will easily identify where they are stored – making them vulnerable to attack. The most effective means of protecting private keys therefore is to store and process them in a secure hardware device or hardware security module (HSM) that will ensure that private keys are always protected from compromise.

The tamper-resistant security modules integrate directly with a web server and store all the private keys and host all cryptographic functions. The most secure devices – such as nCipher’s nShield HSM – are validated to FIPS 140-2 Level 3, the most widely recognised security benchmark for secure cryptographic modules.

The importance of securing keys in hardware has also been recognised by VeriSign, the world’s leading provider of digital certificates. For the first time a commercial SSL certificate has been created specifically for organisations that wish to protect their website with hardware.

VeriSign and nCipher have joined forces to counter the threat of web site spoofing and online data theft with a new premium grade VeriSign SSL certificate that is protected in a FIPS 140-2 certified HSM throughout its lifecycle.

Companies implementing VeriSign’s Hardware Protected SSL Certificate will be able to display a distinct VeriSign Secure Site Seal on their websites that will giver users greater confidence in doing business online.

Beyond the web server

With hardware security, SSL is capable of authenticating the website and securing data as it travels between a browser and a web server – but what risks lay beyond the web server? After all, if an SSL session is terminated on a web server and sensitive information – such as a password and PIN for example – is unencrypted and left exposed, the point of weakness is simply shifted. This is in fact a common scenario, as authentication information often needs to be stripped and compared with data stored in a back-end database for validation.

The challenge therefore, is to extend the security provided by SSL deeper into the website infrastructure in order to protect data behind the firewall from internal as well as external attacks. As the concept of perimeter security, relying solely on creating a secure network boundary around an organisation, becomes outdated it becomes even more important to protect sensitive information wherever it flows, inside or outside a corporate network. To achieve this, the same tamper-resistant hardware protected environment used to store SSL keys can now be used to terminate SSL sessions, process unencrypted data and pass traffic securely on to other back-end applications.

SSL has come along way and the encryption protocol is now being widely adopted as a major industry standard. What lies behind the simple padlock is a complex technology that underpins the security of the Internet. Providing that it is deployed correctly, which typically includes the use of a dedicated HSM for any organization handling sensitive information, SSL delivers the all important level of trust that is vital if more of us are going to have the confidence to buy and do business online.

What is SSL

The SSL protocol was developed in 1994 by Netscape – one of the early Internet browser pioneers – for securing web transactions and messages over the Internet and today is included in all standard browsers along with most web server products. SSL uses a process of public key encryption to secure the connection between your web browser and a remote web server.

Public key encryption uses a pair of asymmetric keys for encryption and decryption. Each pair of keys consists of a public key that anyone can know and a private key that is never distributed and always kept secret. Data encrypted with the public key can be decrypted only with the private key. Conversely, data encrypted with the private key can be decrypted only with the public key.

When a customer uses a web browser to connect to an online store to carry out a purchase or visits their online bank, the SSL protocol causes the vendor’s web server to present its public key in the form of a digital certificate to the customer’s web browser, to identify and authenticate itself. The customer’s web browser then creates and encrypts a ‘session key’ using the public key information stored in the digital certificate. This session key is returned to the vendor’s web server, where it is unencrypted using the web site’s own and hopefully secret private key.

Only the correctly matching private key can decode the message, so the communication between the two parties is secured with a single shared secret key. Secure communication can then take place between the vendor’s web server and the customer’s web browser. Simple!