Getting Up to Speed with "Always-On SSL"

On July 24, Google followed through on its announced plans to mark web pages that did not use HTTPS as "not secure" in Chrome. The Google Chrome 68 "not secure" warning occurs even on pages that don't share or collect any kind of confidential information. The sites labeled "not secure" by the world's most popular browser include those of large brands such as ESPN, Fox News, the NBA, and The Los Angeles Times. The consequences of a "not secure" label can be considerable. Negative trust indicators like this one can stifle use of websites by creating anxiety about their safety. This harmful effect can occur even if it is not a site where transactions take place.

In addition to loss of confidence and decreased transactions, the "not secure" warning can also damage a company's brand. A recent study by research firm DevOps reveals that 97% of active Internet users want to do business with companies that protect their confidential information, and 91% want to do business with companies that invest in best-of-breed security solutions. The presence of an Extended Validation (EV) certificate — or the recognizable "green bar," as it is known — improves consumer perception of a company's stability, level of customer service, and ability to meet its commitments, presumably because they see a clear signal that this company is investing in best-of-breed security solutions to protect its customers. The "not secure" warning has the opposite effect, strongly suggesting that this company is not investing in the best available website security or doing all it can do to protect users. When trust goes away, so does revenue.

Furthermore, distrusted certificates will no longer enable encryption, leaving any shared, sensitive data such as personally identifiable information, credit cards, logins, and personal health information (PHI) exposed to spying and theft.

The solution to Chrome's "not secure" warning is to implement Always-on SSL (AOSSL). AOSSL is the practice of securing all pages on a site with SSL regardless of whether or not they include forms, logins, the ability to make purchases, or the sharing of confidential information. Companies have been perfecting the AOSSL process for the past decade, and today AOSSL can be effective, reliable, easy to implement and maintain, and cost-efficient.

When implementing AOSSL for online properties, these best practices allow for optimal results:

Web security has always served two customers. It provides protection not only for the businesses that operate sites but also for the customers, partners, and employees who use them. This second group is critical to the success of any business site, and the level of trust they can maintain goes a long way in determining the success of these sites. All businesses from big to small should make sure they're adopting AOSSL to inspire the greatest confidence possible and keep those revenue numbers going in the right direction.

Related Content:

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.