{"id":5928,"date":"2018-02-21T12:06:24","date_gmt":"2018-02-21T17:06:24","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=5928"},"modified":"2018-02-22T15:36:12","modified_gmt":"2018-02-22T20:36:12","slug":"encryption-watch-almost-half-us-federal-websites-still-not-secure","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/encryption-watch-almost-half-us-federal-websites-still-not-secure\/","title":{"rendered":"Encryption Watch: Almost Half of US Federal Websites are Still Not Secure"},"content":{"rendered":"

46% federal websites still not compliant with Homeland Security Department\u2019s Directive<\/h2>\n

The latest report by Pulse, a project of the General Service administration, shows that only 54% of federal websites have been able to meet the deadline to enhance website security<\/a>.<\/p>\n

In October 2017, the Department of Homeland Security (DHS) issued an operational directive for government agencies to make security improvements to their sites. The primary requirement of this directive was to migrate their sites from insecure HTTP to encrypted HTTPS within three months by installing SSL\/TLS certificates. Unfortunately, almost 30% of the agencies failed to do so in time.<\/span><\/p>\n

A similar directive was issued in the Obama era as well. During the Obama administration, the agencies were given the deadline of January 2017. Around 70 percent of the sites met this deadline. However, the subjected agencies differ for both these directives. Therefore, it\u2019d be unfair to compare them.<\/p>\n

Now you might be wondering why there\u2019s so much fuss about this HTTPS thing. Well, whether you think it\u2019s a \u201cfuss\u201d or not, it\u2019s totally justified.<\/p>\n

It\u2019s no secret that HTTPS is the spinal cord of web security. It’s the protocol that facilitates securely encrypted connections between a website and a web browser\u2014so that no malicious 3rd<\/sup>-party can come in between and steal or tamper with the data. That\u2019s called a Man-in-the-Middle attack and 30% of government websites are susceptible.<\/p>\n

Still think it\u2019s a \u201cfuss?\u201d I didn\u2019t think so.<\/p>\n

Another key requirement that DHS insists upon is the usage of HSTS (HTTP Strict Transport Security).<\/a> Fundamentally speaking, HSTS forces web browsers to only make connections via secure HTTPS, which protects against downgrade attacks. Here too, government websites fall well short of expectations. Almost 40% of the government\u2019s domains haven\u2019t implemented HSTS yet. As a result, some of these websites might still be in danger, even if they have installed an SSL certificate and migrated to HTTPS.<\/p>\n

The Silver Lining<\/h2>\n

I won\u2019t (and can\u2019t) blame you if you\u2019re feeling pessimistic after reading these numbers. However, as they say, \u2018every cloud has a silver lining.\u2019 In this span of three months, the number of HTTPS-enabled websites has almost doubled. It\u2019s fair to say that this is a solid improvement. And with Google planning to deprecate HTTP starting in March, the rate of adoption should continue to grow.<\/p>\n

What we Hashed Out<\/h2>\n
    \n
  • 46% of federal websites are still not compliant with Homeland Security Department\u2019s Directive<\/li>\n
  • 30% of federal websites are unencrypted (non-HTTPS)<\/li>\n
  • Out of all the sites that are encrypted, around 17% still incorporate insecure protocols that are deprecated<\/li>\n
  • 40% of the sites haven\u2019t implemented HSTS<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

    46% federal websites still not compliant with Homeland Security Department\u2019s Directive The latest report by Pulse, a project of the General Service administration, shows that only 54% of federal websites…<\/p>\n","protected":false},"author":10,"featured_media":5930,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[17],"tags":[170],"class_list":["post-5928","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry-lowdown","tag-https","post-with-tags"],"views":8387,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/02\/iStock-458963295.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/5928","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=5928"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/5928\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/5930"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=5928"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=5928"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=5928"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}