| |
SSL Certificate Information Centre
What is SSL?
The Secure Sockets Layer (SSL) (and Transport Layer Security (TLS)) is the most widely deployed security protocol used today. It is essentially a protocol that provides a secure channel between two machines operating over the Internet or an internal network. In today’s Internet focused world, we typically see SSL in use when a web browser needs to securely connect to a web server over the insecure Internet. Technically SSL is a transparent protocol, which requires little interaction from the end user when establishing a secure session. For example, in the case of a browser, users are alerted to the presence of SSL when the browser displays a padlock, or in the case of Extended Validation SSL the address bar displays both a padlock and a green bar. This is the key to the success of SSL – it is incredibly simple experience for end users.
So in practice how is SSL used in today’s modern ecommerce enabled society?
- Web traffic such as credit card transactions. In 2006 alone there were 210 million users online spending over $130 billion through their PCs / laptops / PDAs and mobile phones. SSL *should* have been used to secure each and every one of these transactions!
- Other web traffic such as login pages, web forms, web mail, control panels or just protected areas of web sites.
- The transfer of files over https and FTP services such as web site owners updating new pages to their web sites.
- Email client to email server connections such as Microsoft Outlook to Microsoft Exchange.
- Intranet based traffic such as intranets, extranets and database connections.
All these applications have a number of shared themes:
- The data being transmitted over the Internet or network needs confidentiality, in other words, people do not want their credit card details to be exposed over the Internet.
- The data needs to remain integral, which means that once credit card details and the amount to be charged to the credit card have been sent, a hacker sitting in the middle cannot change the amount to be charged and where the funds should go.
- Your organisation needs to assure your customers / extranet users that you are who you really say you are and not someone masquerading as you.
- Your organisation needs to comply to regional, national or International regulations on data privacy, security and integrity.
|
|
