What to Consider When Upgrading Agency Encryption
Pixza Studio / Shutterstock.com
Connecting state and local government leaders
TLS secures Internet transactions better than SSL with its newer, stronger algorithms.
Researchers at Google discovered a serious flaw in the Secure Sockets Layer 3.0 (SSL3) protocol last fall. They detected the flaw when the browser was hit by the “POODLE” attack, which came on the heels of several similar, earlier attacks.
SSL is the almost-20-year-old system designed to secure Internet transactions.
The vulnerability lets attackers interrupt the negotiation of encryption, downgrading in-transit data protection to a weaker encryption—giving the hacker access to the confidential information inside the transaction.
POODLE underscored the fact that it has become relatively easy for attackers to unravel SSL3 connections.
It was the final nail in SSL’s coffin.
Technology experts promptly called for browsers and websites to turn off SSL3 and upgrade to Transport Layer Security 1.1 or greater encryption.
TLS protects users’ private information better than SSL3 does because it offers a newer and stronger set of algorithms. These new algorithms and modes of encryption offer additional ways of processing and creating more secure combinations.
Fast SSL3 Shutdown Can Create Problems
For government, however, a quick, wholesale shutdown of SSL3 would hinder some agencies’ ability to deliver services to end users.
Switching to newer versions of TLS will require upgrading end users and older equipment and retraining end users to use the new equipment and services.
Many agencies, for example, interact with customers using point-of-sale hardware installed with SSL3 technology. These POS devices, built when SSL3 was state-of-the-art, are designed for heavy use and therefore are more rugged and longer-lasting than typical computers are.
Replacing the machines will require significant cost for the agencies that use them. At a $300 to $600 per-station outlay, plus licensing fees, even a small installation will run tens of thousands of dollars.
While most mainstream Web browsers have supported TLS for several years, discontinuing SSL use immediately could cause an agency to lose customers that still utilize Windows XP and older versions of Internet Explorer on their computers. That number could be as high as 20 percent to 30 percent of end users.
These older technologies won’t support TLS v1.1, so, when an end user with one of these systems tries to connect to the agency’s service, the connection isn’t allowed and the agency appears to be offline.
PCI Standards Require Migration to TSL
Following suit with the industry recommendation to end the use of SSL, the Payment Card Industry Security Standards Council released a special bulletin early this year requiring complete migration away from SSL protocol by June 30, 2016, for all services that are subject to PCI compliance.
Recognizing that they will have to disable SSL by the middle of next year, affected agencies have the next few months to prepare for and lessen the impact of the change.
These agencies should start now to educate their customers that the shift is coming. Users who connect insecurely should be presented with an on-screen notice warning them that their systems no longer will be supported when the security protocol is updated next year.
By encouraging customers to upgrade their own systems, agencies potentially can reduce the percentage of users who will be negatively affected next June.
Options for Lower-Risk Agencies
While a move to TLS is advisable for all agencies, those whose services are not subject to PCI standards have the option of evaluating whether SSL3 might continue to work well for them, at least for some time.
To determine what percentage of customers is likely to be affected if the agency gets rid of SSL technology, these agencies can review the technology their website’s support, assess the logs of site visits to see what operating systems customers are using to connect and detect how many visitors use SSL3 technology.
Agencies that interact mostly with other agencies or businesses, rather than the general public, may be at less risk for SSL3 attacks than are agencies whose services focus on the general public. These agencies may consider adding whitelisting or other compensating controls to continued SSL3 use.
If, for example, an agency analyzes its applications and finds that all users are coming from a single network, the agency may consider containing the risk by making those services only available to that network.
Whether an agency decides to transition to TLS 1.1 or newer right away or down the road, hard and soft costs may be high.
For agencies whose services aren’t subject to PCI compliance, the good news is that there’s an opportunity to evaluate the timeline and phase in the costs.
Rodney Caudle is Director of Information Security at NIC Inc., the nation’s largest e-government services provider, and has more than 20 years of experience in information security.
NEXT STORY: New Jersey Tops Rankings of State Property Tax Rates