Summary
This discussion brief argues that enterprises should run HTTPS on every web property, including brochure sites and domain redirects. Browser and search firms are forcing the change, and operating without HTTPS increasingly compromises brand trust, SEO performance and web engagement.
Operating web properties without HTTPS will increasingly compromise brand market trust, impacting SEO performance and limiting web engagement. Browser and search firms are forcing all web managers to implement HTTPS everywhere.
Peter LaMantia, CEO, Authentic Web Inc.
Key points
- Since July 2018, Chrome 68 marks all HTTP pages as “not secure”. Google search has favored HTTPS pages since 2014.
- As of August 2018, Chrome, Safari and Firefox made up almost 80% of browser traffic, and all three are moving the same way.
- Four reasons to cover 100% of properties: customer trust and brand reputation, customer security, digital performance and SEO.
- Five operational problems: painful certificate administration, TLS without DNSSEC, certificate authority compromises, unencrypted redirect domains and changing TLS cipher suites.
Risks and new best practices in a zero trust world
The internet is an increasingly risky place for users, and enterprises and their customers are particularly vulnerable. As corporate and personal data and applications move to the cloud, the enterprise attack surface expands beyond perimeters that are easy to see or defend. The “castle moat” model is obsolete. Zero Trust (Forrester) calls for positive authentication of every user and system connection, asking: Who are you? Where are you from? Where are you going? Why are you going there?
Browser firms, working with the CA/Browser Forum, continue to push encryption and authentication together. Google, Mozilla and Apple have each announced new HTTPS standards that every website operator needs to know about. Correctly deployed and managed SSL certificates help in three ways:
- Encryption prevents parties from seeing data exchanged in an internet session.
- Encryption prevents parties from impersonating web pages for fraud.
- The right type of validation assures visitors that the brand’s relationship to the domain is authentic.
SSL/TLS is no longer recommended only for transactional pages. All page content should be encrypted, including brochure sites and domain redirects. (The paper uses “SSL certificates”, “TLS certificates” and “HTTPS certificates” interchangeably.)
Encryption evolution in major browsers
Google Chrome
From July 2018, Chrome 68 identifies all HTTP pages as “not secure” in the browser window, whatever the page type. Chrome 70 was expected to go further and show the “not secure” alert in red. Google’s search algorithms have favored HTTPS over HTTP since 2014, on the argument that “users should expect that the web is safe by default”, and HTTP pages can be expected to be disadvantaged further with later Chrome releases.
Mozilla Firefox and Apple Safari
Mozilla and Apple are following suit. As of August 2018, Chrome, Safari and Firefox comprised almost 80% of all browser traffic (StatCounter), so IT and web managers have little choice but to implement SSL encryption everywhere.
Implications for the enterprise: four reasons for 100% HTTPS
- Customer trust and brand reputation. Browsers expose brands without secure sites and are shaming site owners into locking down with HTTPS. Customers expect you to be secure.
- Customer security. Lack of encryption opens the door to attacks on your users. Regulations including GDPR put teeth behind these best practices.
- Digital performance. As browsers flag unencrypted sites more visibly, site abandonment is expected to rise, and visitor engagement drives digital business performance.
- Search engine optimization. Google announced better ranking for encrypted sites in 2014, and experts predict further degraded rankings for unencrypted sites.
Mapping certificate types and costs to web property types
Which pages should be encrypted? All of them. Technically a certificate is a certificate whether it is domain validated (DV), organization validated (OV) or extended validation (EV). A properly implemented DV certificate meets the browsers’ encryption requirement, and certificates with extra CA requirements add trust. What teams need is a policy, a budget and software tools to manage the environment. Guide by page type, including redirects:
| Page type | Examples | Certificate type | Volume (% of portfolio) | Cost per cert per year |
|---|---|---|---|---|
| Transactional | Main site, e-commerce, payments, financial data collection | OV or EV preferred for added trust | Low: 1 to 2% (main site) | $100 to $1,000 |
| Private data | Registration sites, forms, any pages requesting personal or private data | OV or EV preferred for added trust | Moderate: 3 to 5% (campaign pages, forms, customer interactive) | $100 to $1,000 |
| Brand identity | High-traffic branded properties | DV unless the brand seeks more trust with OV or EV | Moderate: 3 to 5% (campaign, product or service microsites) | $15 to $30 |
| Brochure or read-only | Blog sites, text-only sites (no forms or data exchange) | DV unless the brand seeks more trust with OV or EV | High: 10 to 20% (depends on type of business and digital strategy) | $15 to $30 |
| Redirects to any site or deep link | Pages that redirect to another domain page must be encrypted under HTTPS | Use an HTTPS redirect service solution | Very high: 50 to 70% (redirects to relevant destinations inside websites, campaign or product pages) | $7 to $12 |
Notes: the share of the portfolio by site type varies with the business and digital strategy; the ranges are what Authentic Web sees on typical domain portfolios. Prices vary by CA, reseller and volume agreement, exclude options such as wildcard and SAN/UCC certificates, and some certificate types (for example Let’s Encrypt) are free.
Operational challenges in managing SSL certificates
Budgeting for the right certificates is easy. Operationalizing an HTTPS policy with control, visibility and automation is much harder, and managing certificates is error-prone and administratively costly. Five issues to know:
1. TLS certificate administration is painful
Enterprise certificates expire without warning or get misconfigured because the process is manual. The steps run from creating a private key and storing it securely, preparing and submitting a CSR to the CA, ordering the certificate and choosing the domain validation method, through receiving and installing the signed certificate (which varies by server type), to testing that HTTPS is active, tracking the renewal date and renewing. An error at many of these steps can invalidate the certificate: a wrong certificate type (shared, DV, OV, EV), a poor choice of CA, incomplete CSR documents, an insecure or invalid key, or a bad install that invalidates existing certificates.
Solution. Adopt modern domain, DNS and TLS management systems to control, visualize and automate change management.
2. TLS encryption without DNSSEC
Encryption matters, and so does authentication. DNSSEC complements HTTPS by ensuring DNS data is valid for the intended destination.
Solution. Implement DNSSEC to reduce the risk of site visitors being tricked or compromised by man-in-the-middle exploits.
3. Certificate authority compromises
CAs are expected to be rock-solid but are not. Human error, on both the enterprise and CA side, and system faults have invalidated or compromised numerous high-profile CAs. Not all CAs are the same.
Solution. Configure the correct certificate type for each domain endpoint, and manage all SSL certificates in one control system that monitors endpoints with tamper-proof audits, change management digests and remediation.
4. Unencrypted redirect domains
Most enterprises have hundreds or thousands of redirected domains pointing to deep links, and most are not encrypted through oversight or the mistaken idea that they don’t need it. An HTTP origin domain negates the encryption even when the destination is HTTPS, creating an attack vector for code injection against customers.
Solution. Source and enable an HTTPS redirect solution on all redirecting domains.
5. Managing change in TLS cipher suites
SSL protocols have been replaced by TLS versions from 1.0 to 1.3, and community groups decide when older versions need updating. Security teams must make sure endpoint servers use current ciphers. HTTPS certificates on older cipher suites may expose users to known risks.
Solution. Adopt SSL management control systems that monitor and report which TLS cipher versions are in use.
Summary and best practices
Brand trust is critical, and HTTPS everywhere is quickly becoming the standard customers expect. Browsers show clear warnings on unencrypted sites, and search links to insecure pages may eventually be disabled. Short-term effects of unencrypted pages are eroded brand trust, higher abandonment and lower SEO rank. The paper calls 2018 a watershed year as browsers and search engines mandate that every web property be HTTPS enabled. Six take-aways:
- Establish a baseline and identify the gap. Audit your domain portfolio for your TLS security baseline, then plan, resource and implement the fix.
- Define your SSL security policy. Map SSL types to hosts by the sites you serve, and monitor hosts for compliance.
- Know your cipher suites and update web servers to support TLS 1.3. Define compliant cipher suites in the policy. As of late 2018, TLS 1.3 is recommended; install it everywhere and monitor versions in use.
- Implement DNSSEC. It reinforces encryption with DNS lookup authentication. Automate signing and maintenance of DNSSEC on zone files.
- Ensure redirect domains are properly encrypted. Unencrypted redirected domains are an emerging security gap. Audit and force HTTPS redirects to destination properties.
- Modernize your systems. Manage domains, DNS and TLS in a single secure, compliant DNS control system. Research cited in the paper finds manual processes and operational silos are the main factors behind brand security risk.
Authentic Web offers a free DNS and TLS audit: info@authenticweb.com.