Is HTTPS enough to protect governments?. (September 2015)

• Record Type: Journal Article
• Authors: Bocek, Kevin
• Is Part Of: Network security. (2015:Sep.)
• Page Start: 5
• Page End: 8
• Publication Date: 2015-09
• Subjects: Computer security -- Periodicals; Computer networks -- Security measures -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; Computers -- Access control -- Periodicals; 005.805
• DOI: 10.1016/S1353-4858(15)30079-9
• Languages: English
• ISSNs: 1353-4858

Abstract

Abstract : The US Government is rapidly trying to shore up its security after a series of devastating attacks, by introducing a new requirement: the use of HTTPS and cryptographic keys and digital certificates. This is a promising start, but to really protect and verify websites, the public key infrastructure needs an immune system to root out untrustworthy certificates that have been stolen or issued from compromised Certificate Authorities (CAs). Here's how we get there. The recent hacks into the US Federal Government's Office of Personnel Management exposed significant weaknesses in its information security architecture. The response – to introduce HTTPS for all US government sites – is only a relatively modest and still inadequate start. What is needed is a more comprehensive management system for certificates along with the adoption of the US Government's own guidelines on preventing and responding to compromises of Certificate Authorities, as Kevin Bocek of Venafi explains.