GlobalSign

From Wikipedia, the free encyclopedia
Jump to: navigation, search
GlobalSign
Type Private company
Industry Computer security, Internet security
Founded Belgium (1996 (1996))[citation needed]
Headquarters Cambridge, Massachusetts, United States
Website www.globalsign.com

GlobalSign is a WebTrust-certified certificate authority (CAs) company, and a founding member of the CA/Browser Forum, the certificate authority industry standards group.

Founded in 1996.[1] and presently a subsidiary of GMO CLOUD K.K. in Japan,[2] the company offers a diverse range of certificate-related products.

Services[edit]

The company provides publicly trusted X.509 compliant SSL, including the new Extended Validation Certificate, S/MIME and code signing certificates for use on all popular platforms including mobile. Other services include a trusted root certificate authority (CA) chaining program for trusted PKI deployments, which allows the widely distributed[3] and trusted GlobalSign root CA certificates to cryptographically chain subordinate root CAs for use in Microsoft CA and other in-house CAs. Such chaining allows these non-commercial CAs to control their own internal PKI, typically issuing SSL and digital IDs for secure email and two factor authentication. These solutions enable end-users to conduct secure online transactions and data submission, providing tamper-proof distributable code as well as to bind identities to client certificates for email security and remote two factor authentication, such as SSL VPN. GlobalSign has introduced digital certificates for signing Adobe Systems PDF documents[4] and also Microsoft Office documents and VBA Macros.[5]

SSL configuration checker[edit]

In November 2012 GlobalSign launched this free online service which allows website administrators to confirm that they have correctly configured SSL across their websites and receive actionable guidance on how to remediate any faulty or exploitable SSL configurations. Correctly configured SSL improves website performance and strengthens security, allowing organizations to preserve the end-user experience and provide better defense against SSL BEAST, CRIME, and other common and damaging attacks that exploit faulty SSL configurations. Any organization can use the service by visiting sslcheck.globalsign.com. Once there, users simply enter the URL of the website they want to check. After a brief scan, the user receives a letter grade with a simplified explanation of any issues found in the website's SSL configuration and actionable remediation steps. The SSL Configuration Checker integrates the assessment technology of Qualys SSL Labs, which is focused on auditing the SSL ecosystem, raising awareness, and providing tools and documentation to web site owners so they can improve their SSL implementations. The tool is available in Dutch, English, French, German, Japanese, Russian and Spanish. [6]

Memberships and awards[edit]

GlobalSign is a founding member of the CA/B forum, a voluntary consortium of certification authorities, vendors of Internet browser software, operating systems, and other PKI-enabled applications that promulgates industry guidelines governing the issuance and management of X.509 v.3 digital certificates that chain to a trust anchor embedded in such applications.

GlobalSign is also a founding member of the Certificate Authority Security Council, a multi-vendor industry advocacy group created to conduct research, promote Internet security standards and educate the public on Internet security issues

GlobalSign has been recognized by the Online Trust Authority (OTA) as Web Compliant since 2001.

Additionally, Chief Product and Marketing Officer Lila Kee is an executive member on the North American Energy Standards Board (NAESB). Kee is a board member on the Wholesale Electrical Quadrant Board of Directors where she takes a lead role in the development of security best practices and standards needed to secure electric-industry wholesale business applications.

Recognized industry firsts[edit]

GlobalSign was the first CA to improve revocation (page load) speed for HTTPS pages.[7]

The company was also the first to offer IPv6 compliant revocation services.[8]

2011 hacking incident[edit]

In September 2011, GlobalSign suspended issuing authentication certificates temporarily after an anonymous hacker compromised their servers.[9] An Iranian student self-identified as "Comodohacker", who also claimed responsibility for the 2011 Comodo and DigiNotar breaches,[10] claimed that he had also hacked the systems of GlobalSign.[11] GlobalSign took the claim seriously enough to halt the signing/issuing of new certificates while investigating the claims; it resumed issuing certificates a week later.[12]

Dutch security company Fox-IT was contracted to analyze the breach and GlobalSign released a security incident report.[13] On December 13, 2011 GlobalSign released its final report on the incident. The report concluded that while GlobalSign's own web server was breached and the certificate of this server was stolen, due to the air gap separating this web server from the certificate-issuing machine (the one holding the company's root certificate), there was no evidence of any rogue certificates issued or any customer data exposed, thus the remedial actions were limited to cancelling their own web server's certificate and patching its software.[13][12] Sophos’s Chester Wisniewski summarized the report and GlobalSign’s response to the incident on his blog and concluded “Not only is the report thorough and convincing, but it appears that GlobalSign took every action, exactly as they should have, both during and after the incident.”[14]

See also[edit]

External links[edit]

Sources and references[edit]

  1. ^ "GlobalSign, Doing more than any other CA...". 2013-01-14. Retrieved 2013-08-13. 
  2. ^ "Corporate summary". 2013-04-22. Retrieved 2013-08-13. 
  3. ^ "GlobalSign Certificate Authority Root". GlobalSign. 
  4. ^ "PDF Signing - Apply Digital Signatures with Adobe CDS". GlobalSign. 
  5. ^ "Digital Signatures for Office Documents". GlobalSign. 
  6. ^ "GlobalSign SSL Configuration Checker Provides Guidance to Reduce Cybercriminals' Ability to Exploit Faulty SSL Configurations". 2012-11-15. 
  7. ^ CloudFlare Partners With GlobalSign To Make Loading Secure Web Pages Up To 6 Times Faster. TechCrunch (2012-11-01). Retrieved on 2013-07-26.
  8. ^ GlobalSign First CA to Offer Certificate Revocation Status Services over IPv6. Thewhir.com (2013-03-13). Retrieved on 2013-07-26.
  9. ^ BBC News - GlobalSign stops secure certificates after hack claim. Bbc.co.uk (2011-09-07). Retrieved on 2013-07-26.
  10. ^ Mikko Hypponen (2011-09-06). "DigiNotar Hacker Comes Out". 
  11. ^ Sterling, Toby. "Another Firm Stops Issuing Website Security Certificates In Wake Of Dutch Hack." Canadian Press, 6 Sep. 2011: Newspaper Source Plus. Web. 30 May 2013.
  12. ^ a b http://www.zdnet.com/blog/btl/unpatched-server-led-to-globalsign-breach/75374
  13. ^ a b Steve Waite (2011-12-13). "Security Incident Report". 
  14. ^ Chester Wisniewski (2011-12-15). "Google and EFF propose improvements to HTTPS as GlobalSign releases CA breach report".