Why You Need SSL Certificate?

How Does SSL Work?

This Presumes That SSL Has Already Been Issued By SSL Issuing Authority.

 

 

What Type of SSL Certificate is Suitable for Your Website?

PERSONAL (Secure 1 Domain)	BUSINESS (Secure 1 Domain)	BUSINESS (Secure 1 Domain & All Subdomains)
Domain (DV) Validation	Extended (EV) Validation	Organization (OV) Validation
GREEN BAR	GREEN BAR	GREEN BAR
Provide basic encrpytion for personal websites	Suitable for business websites dealing with sensitive transactional data	Ideally for organization websites with many subdomains
Use when visitors trust and credibility are less concerned	Make potential customers feel safe to do business on your websites	Efficient solution to secure several subdomains with one SSL

Compare Types of SSL Certificate

	Domain Validation (DV)	Organization Validation (OV)	Extended Validation (EV)
Address Bar Padlock
Trust Seal
Prove Domain Ownership
Show Organization Identity Info
Green Address Bar
Recommended For	Personal sites, blogs & small forums	Online business dealing with transactional data	E-commerce sites and enterprise websites handling sensitive data
Best Used For	Basic encryptions for non-transactional data such as logins, forms	Make your customers assured about the safety of their sensitive info such as credit card or bank account details	Long term investment to build your credibility as the most trusted business with Green Address Bar, the highest visible display of trust

Researchers warn about a kind of malware that can deliver profits without being obvious to users. — AFP Relaxnews

The attack is the first major incident made public in which a new breed of hackers took over a large numbers of websites to effectively create currencies like bitcoin which are generated by using computing power.

The attacks made public over the weekend by British security researcher Scott Helme showed more than 4,000 website were infected in this manner, including those of the British data protection and privacy watchdog and the US federal courts system.

Unlike traditional attacks, these infections do not contain “ransomware” or steal data, but operate in stealth mode to make profits from the shadowy world of cryptocurrencies.

Helme said in a blog post that the hackers were able to reach large numbers of websites by infecting a commonly used “plug-in,” or software which helps a site run better. In this case, the hackers used the malicious software to create Monero, one of several new cryptocurrencies which are making a splash in financial markets.

“If you want to load a crypto miner on 1,000 websites you don’t attack 1,000 websites, you attack the one website that they all load content from,” he said.

The creator of the plug-in, the British software firm TextHelp, said it took the affected software offline after it discovered the “attempt to illegally generate cryptocurrency”. “This was a criminal act and a thorough investigation is currently underway,” the company said in a statement.

Researchers have been warning in recent weeks about this kind of malware, which can deliver profits without being obvious to users. Security researchers at Cisco Talos warned last month that this kind of hacking activity “has exponentially increased”.

Because of the huge financial gains in cryptocurrencies, Cisco researchers said this has become a prime target for hackers. “At a high level mining is simply using system resources to solve large mathematical calculations which result in some amount of cryptocurrency being awarded to the solvers,” Cisco researchers wrote in a research note.

Security researcher Graham Cluley said the latest attack highlights vulnerabilities in websites which may have weaknesses in third party components.

“Things could have been much worse,” Cluley said in a blog post. “Imagine if the plug-in had been tampered with to steal login passwords rather than steal CPU resources from visiting computers.” — AFP Relaxnews

Source: The Star Online

Intel said it was working with AMD and ARM Holdings and with the makers of computer operating software “to develop an industry-wide approach to resolve this issue promptly and constructively.” — Reuters

WASHINGTON: A newly discovered vulnerability in computer chips raised concerns Jan 3 that hackers could access sensitive data on most modern systems, as technology firms sought to play down the security risks.

Chip giant Intel issued a statement responding to a flurry of warnings surfacing after researchers discovered the security hole which could allow privately stored data in computers and networks to be leaked.

Intel labelled as incorrect reports describing a “bug” or “flaw” unique to its products.

Intel chief executive Brian Krzanich told CNBC that “basically all modern processers across all applications” use this process known as “access memory,” which was discovered by researchers at Google and kept confidential as companies work on remedies.

Google, meanwhile, released findings from its security researchers who sparked the concerns, saying it made the results public days ahead of schedule because much of the information had been in the media.

The security team found “serious security flaws” in devices powered by Intel, AMD and ARM chips and the operating systems running them and noted that, if exploited, “an unauthorised party may read sensitive information in the system’s memory such as passwords, encryption keys, or sensitive information open in applications.”

“As soon as we learned of this new class of attack, our security and product development teams mobilised to defend Google’s systems and our users’ data,” Google said in a security blog.

“We have updated our systems and affected products to protect against this new type of attack. We also collaborated with hardware and software manufacturers across the industry to help protect their users and the broader web.”

Spectre and Meltdown

The Google team said the vulnerabilities, labelled “Spectre” and “Meltdown,” affected a number of chips from Intel as well as some from AMD and ARM, which specializes in processors for mobile devices.

Intel said it was working with AMD and ARM Holdings and with the makers of computer operating software “to develop an industry-wide approach to resolve this issue promptly and constructively.”

Jack Gold, an independent technology analyst, said he was briefed in a conference call with Intel, AMD and ARM on the issue and that the three companies suggested concerns were overblown.

“All the chips are designed that way,” Gold said.

The companies were working on remedies after “some researchers found a way to use existing architecture and get into protected areas of computer memory and read some of the data,” he added.

Microsoft said in a statement it had no information suggesting any compromised data but was “releasing security updates today to protect Windows customers against vulnerabilities.”

But an AMD spokesman said that because of the differences in AMD processor architecture, “we believe there is near zero risk to AMD products at this time.”

ARM meanwhile said it was “working together with Intel and AMD” to address potential issues “in certain high-end processors, including some of our Cortex-A processors.”

“We have informed our silicon partners and are encouraging them to implement the software mitigations developed if their chips are impacted,” the SoftBank-owned firm said.

Slowdown?

Earlier this week, some researchers said any fix – which would need to be handled by software – could slow down computer systems, possibly by 30% or more.

Intel’s statement said these concerns, too, were exaggerated.

“Contrary to some reports, any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time,” the company statement said.

Tatu Ylonen, security researcher at SSH Communications Security, said the patches “will be effective” but it will be critical to get all networks and cloud services upgraded, Ylonen said.

British security researcher Graham Cluley also expressed concern “that attackers could exploit the flaw on vulnerable systems to gain access to parts of the computer’s memory which may be storing sensitive information. Think passwords, private keys, credit card data.”

But he said in a blog post that it was “good news” that the problem had been kept under wraps to allow operating systems such as those from Microsoft and Apple to make security updates before the flaw is maliciously exploited. — AFP

Source: The Star Online