Entrust extends validation for e-commerce with next-gen SSL certificates

Source: Entrust

Each day, online consumers are becoming more and more cautious during routine Internet transactions.

Many know what elements to look for and what to avoid online. Unfortunately, criminal organizations continue to cast such a wide net that they have little trouble finding new victims.

In support of society's increased online awareness, a recent SSL Security Consumer Omnibus Survey, conducted by Entrust (NASDAQ:ENTU), discovered that 85 percent of those who routinely conduct transactions online look for a specific icon or indicator (e.g., the "padlock" used with SSL certificate technology). Unfortunately, standard SSL certificates can sometimes be illegitimately obtained and the padlock icon can be reproduced on browsers, tricking even seasoned Internet users into phishing or man-in-the-attacks fraud attacks.

"It's clear that Internet users are becoming increasingly savvy at protecting themselves online, but the adoption of Extended Validation SSL Certificates by eCommerce companies is the key next step in this fight against phishing and online fraud. The technology represents the first level of defense in a strong, layered security strategy," said Entrust Chairman, President and Chief Executive Officer Bill Conner. "Because online criminal organizations continue to adapt and develop sophisticated fraud tools to attack innocent online consumers, organizations should be proactive in protecting their customers and business."

The new Entrust Extended Validation SSL Certificates - commonly knows as "EV" certificates - contain safeguards to help prevent these types of attacks. When consumers use an EV SSL-aware, next-generation browser, the technology will help allow users to make smarter decisions of trust, such as the ability to verify the identity information of the owner of an EV certificate-protected Web site. When using the new EV-enabled browser, Internet Explorer 7, valid sites will cause the address bar to turn green, and information about the company operating the site and the certification authority (CA) that issued the certificate will be prominently displayed.

"Extended Validation SSL Certificates offer users a way to verify the identity of a business they are interacting with online," said Markellos Diorinos, security product manager for Internet Explorer at Microsoft Corp. "When used in combination with an EV-enabled browser such as Internet Explorer 7, EV SSL certificates are a resource to help improve consumer confidence online."

The reliability of standard SSL technology as a security indicator is dependent on the amount of verification done by the provider. Consumers didn't have an easy way to tell the difference between which sites were thoroughly examined and which weren't - until now. Standard SSL certificates are no longer strong enough to be considered an adequate solution for protection online. Now, EV SSL certificates standardize the vetting process and can better communicate the Web site's identity information to the end-user.

The Jan. 30 launch of Windows Vista is another key factor. While more than 100 million users have already upgraded to Internet Explorer 7 for Windows XP, Windows Vista also includes the new browser and greatly increases the potential user base of those that can benefit from EV SSL certificates.

In support of EV SSL certificates, the survey found that 85 percent of surveyed Internet users would return to a site if a green address bar would advise them on the site's legitimacy. In addition, nearly 70 percent of surveyed online consumers would have more trust in a site if the green address bar was present.

"While Entrust recognizes the evolution of the online consumer, we believe Extended Validation SSL Certificates will be a necessary tool in helping prevent costly online attacks. It's just the first step of many to help thwart online criminal organizations in 2007 and beyond," Conner added.

Of those that don't actively look for specific security indictors, responders said that they are aware or have noticed a variety of security alerts when conducting transactions online. Some of the most popular included: Web browser warning messages (49 percent); a text notice on the site telling them it is secure (43 percent); the padlock icon on the browser (41 percent); and some form of a security site seal (21 percent).

With consumers clearly open to securing their online experience, savvy eCommerce companies are already installing EV SSL certificates to help provide their customers with an added level of confidence that their sites are authentic and validated. As more online consumers realize the benefits of this new technology, demand for organizations to upgrade to EV SSL certificates can be expected to grow.

For those consumers who have yet to upgrade to or adopt the latest, EV- enabled Internet browsers (Internet Explorer 7 is currently the only browser that supports this technology) Entrust EV SSL certificates will still be recognized by older browser versions that are not EV SSL-aware. Although older browsers will not display the company name - or a green address bar - the closed padlock will still be present.

Another major benefit with EV SSL certificates stems from the stringent vetting process. The extended validation term refers to a rigorous, industry- standard validation method to be used by a certification authority (CA) before issuing an EV SSL certificate. The Extended Validation SSL Server Certificate is a new category of SSL certificate created by an industry consortium called the CA/Browser Forum. This new category was conceived in response to the growing threats of phishing and man-in-the-middle attacks. EV SSL certificates will be issued to Web sites only after rigorous validation of their identity. Next-generation Web browsers will reflect this higher level of identity assurance with the aforementioned prominent and distinct trust indicators.

The SSL Security Consumer Omnibus Survey is based on online survey findings collected by Greenfield Online during the week of November 13, 2006. The survey pool consisted of 1,099 consumers who were asked questions about their knowledge of and trust in various Internet security indicators as it relates to SSL secured-Web sites. The profile of respondents was representative of the U.S. Census with an equal split on gender and age groups between 18 and 65-plus.

Comments: (0)