SSL was anything but boring in 2018<\/strong><\/h2>\nBrowser UIs evolved. Again. Not secure warnings hit the net. GDPR went into effect. Comodo CA re-branded as Sectigo. 2018 saw plenty of SSL-related action and we had a front row seat.<\/p>\n
HTTPS is gaining traction <\/strong><\/h2>\nNo doubt about it, the web is becoming more and more encrypted by the day. Articles abound that confirm that the browser\u2019s push for total encryption is becoming a reality. In his November Trend Briefing, DigiCert\u2019s Threat Strategist Jeff Barto shared that more than 80% of page loads in Chrome and 70% in Android are now over HTTPS. While that\u2019s impressive, there\u2019s still plenty that need to make the move, according to our recent blog post<\/a>, roughly 21% of the world\u2019s top 100K sites still aren\u2019t using encrypted connections.<\/p>\nThe SSL market continues to grow<\/strong><\/h2>\nNetcraft\u2019s June 2018 report confirms significant growth in SSL certificates. Specifically, total certificates increased more than 13.2 million or 68% year-over-year from June 2017. And, while 80% of this growth was Domain Validation (DV) certs, Extended Validation (EV) grew 21.1%.<\/p>\n
![\"2018](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/12\/Cert-Type.png\")
<\/p>\n
Source: Netcraft June 2018 Report<\/em><\/p>\nSo, while DV still dominates the market share, there\u2019s also a definite place for premium certificates. Especially when you look at the share of traffic by certificate type.<\/p>\n
![\"2018](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/12\/Traffic-Share.png\")
<\/p>\n
Source: Comscore and Netcraft<\/em><\/p>\nThe percentages even out even more when you look at ecommerce transactions.<\/p>\n
![\"2018](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/12\/eCommerce.png\")
<\/p>\n
Source: Comscore and Netcraft<\/em><\/p>\nA peek at 2019<\/strong><\/h2>\nForecasts are mostly positive for SSL as we look ahead to 2019. Let\u2019s look at what a few industry experts are predicting.<\/p>\n
According to the CA Security Council\u2019s 2019 Predictions:<\/p>\n
\n- More than 90% of the world\u2019s traffic will be secured over SSL\/TLS by the end of 2019 <\/em><\/li>\n
- TLS 1.3 will grow by more than 30% by the end of 2019<\/em><\/li>\n
- Phishing (especially encrypted phishing) will continue to skyrocket<\/em><\/li>\n<\/ul>\n
![\"Jeff](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/12\/Jeff-Barto.jpg\")
Jeff Barto, DigiCert<\/figcaption><\/figure>\nAnd, here\u2019s what DigiCert\u2019s Threat Strategist Jeff Barto sees on the horizon:<\/p>\n
\n- 2019 will be the year we\u2019re going to wake up and demand to know that who we\u2019re connecting to is a legit company<\/li>\n
- Inconsistent trust indicators present both challenges and an opportunity to re-define what they can do and mean, and create new ones<\/li>\n
- This will be the year people get sick and tired of breaches, driving them to take control and take steps to protect their identity<\/li>\n<\/ul>\n
Here\u2019s what we see at The SSL Store™<\/sup>.<\/p>\nSSL isn\u2019t going anywhere but up<\/strong><\/h2>\nIndustry reports support our position that SSL will continue to be an increasingly important staple of every organization\u2019s security budget. The 2018 IDG Security Priorities Study supports the notion that companies are moving toward a more proactive stance, with 74% of respondents reporting that best practices and compliance are key factors that drive their security spending. And, the SSL market overall is predicted to grow at nearly twice the rate of web hosting or domain registration.<\/p>\n
![\"2018](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/12\/Forecast.png\")
<\/p>\n
So, how does an IT manager or advisor help the powers that be understand that SSL needs to be an essential part of their security strategy?<\/p>\n
The SSL conversation needs to be about way more than encryption<\/strong><\/h2>\nThe browser UI changes have certainly had a huge impact on SSL market growth. But that\u2019s not the only thing driving the increasing need for SSL certificates. Here are a few other factors companies need to equally consider when contemplating if they should protect their data, customers and reputation with SSL and which type of certificate to choose.<\/p>\n
Phishing<\/strong>\u2014According to PhishLabs Q3 2018 report, nearly half (49%) of phishing sites are duping visitors into believing they\u2019re safe by enabling HTTPS with DV certificates. And, secure and safe are definitely not the same thing as we pointed out in our November 27 blog post<\/a>. This might explain the steady bump in premium certs as organizations increasingly choose to separate themselves from the phish pond.<\/p>\n![\"2018](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/12\/Stat-Callout-1-e1545421201582.jpg\")
<\/a><\/p>\nPCI Compliance<\/strong>\u2014PCI compliance is a necessary evil of running a business that accepts credit cards and SSL certificates play an important role in meeting these requirements. Here are a few SSL-related issues that can cause a \u201cfail\u201d on a PCI compliance scan if they\u2019re not resolved:<\/p>\n\n- Using expired SSL certificates<\/li>\n
- Using non-publicly trusted SSL certificates in the wrong areas<\/li>\n
- Using lower than 256-bit encryption<\/li>\n
- Using outdated TLS protocol<\/a><\/li>\n<\/ul>\n
Failing a PCI compliance audit could result in hefty monthly fines in the tens, to hundreds of thousands, possible suspension of a company\u2019s ability to handle card payments, plus leaves them more vulnerable to cyberattacks.<\/p>\n
GDPR<\/strong>\u2014These new regulations took effect May 25 of this year and Gartner predicts more than 50% of companies affected still won\u2019t be in full compliance by the end of 2018. Breach penalties are steep at \u20ac20 million or 4% of annual turnover, whichever is higher. Just to put this into perspective, this would equate to $7 billion for Amazon, more than two years of profit. Plus, there may be additional fines based on the type of breach, data exposed, notification, remediation and response. And, this doesn\u2019t include irreparable damage to reputation or costs associated with insurance, legal fees and settlements. Beyond the regulation itself and possible fines, there are other considerations, including companies with partners that want to be GDPR compliant and require them to follow suit. Last, but not least, there\u2019s plain old customer trust and expectations for companies to treat their information with kid gloves. And, some of the requirements in the 99-article GDPR can only be accomplished with SSL certificates.<\/p>\nOne last note about compliance. Companies are, in fact, taking it seriously and backing it with budgets according to the 2018 IDG Security Priorities Study that reports 69% of companies see compliance mandates driving spending.<\/p>\n
No doubt about it, the web is becoming more and more encrypted by the day. Articles abound that confirm that the browser\u2019s push for total encryption is becoming a reality. In his November Trend Briefing, DigiCert\u2019s Threat Strategist Jeff Barto shared that more than 80% of page loads in Chrome and 70% in Android are now over HTTPS. While that\u2019s impressive, there\u2019s still plenty that need to make the move, according to our recent blog post<\/a>, roughly 21% of the world\u2019s top 100K sites still aren\u2019t using encrypted connections.<\/p>\n Netcraft\u2019s June 2018 report confirms significant growth in SSL certificates. Specifically, total certificates increased more than 13.2 million or 68% year-over-year from June 2017. And, while 80% of this growth was Domain Validation (DV) certs, Extended Validation (EV) grew 21.1%.<\/p>\n Source: Netcraft June 2018 Report<\/em><\/p>\n So, while DV still dominates the market share, there\u2019s also a definite place for premium certificates. Especially when you look at the share of traffic by certificate type.<\/p>\n Source: Comscore and Netcraft<\/em><\/p>\n The percentages even out even more when you look at ecommerce transactions.<\/p>\n Source: Comscore and Netcraft<\/em><\/p>\n Forecasts are mostly positive for SSL as we look ahead to 2019. Let\u2019s look at what a few industry experts are predicting.<\/p>\n According to the CA Security Council\u2019s 2019 Predictions:<\/p>\n And, here\u2019s what DigiCert\u2019s Threat Strategist Jeff Barto sees on the horizon:<\/p>\n Here\u2019s what we see at The SSL Store™<\/sup>.<\/p>\n Industry reports support our position that SSL will continue to be an increasingly important staple of every organization\u2019s security budget. The 2018 IDG Security Priorities Study supports the notion that companies are moving toward a more proactive stance, with 74% of respondents reporting that best practices and compliance are key factors that drive their security spending. And, the SSL market overall is predicted to grow at nearly twice the rate of web hosting or domain registration.<\/p>\n So, how does an IT manager or advisor help the powers that be understand that SSL needs to be an essential part of their security strategy?<\/p>\n The browser UI changes have certainly had a huge impact on SSL market growth. But that\u2019s not the only thing driving the increasing need for SSL certificates. Here are a few other factors companies need to equally consider when contemplating if they should protect their data, customers and reputation with SSL and which type of certificate to choose.<\/p>\n Phishing<\/strong>\u2014According to PhishLabs Q3 2018 report, nearly half (49%) of phishing sites are duping visitors into believing they\u2019re safe by enabling HTTPS with DV certificates. And, secure and safe are definitely not the same thing as we pointed out in our November 27 blog post<\/a>. This might explain the steady bump in premium certs as organizations increasingly choose to separate themselves from the phish pond.<\/p>\n PCI Compliance<\/strong>\u2014PCI compliance is a necessary evil of running a business that accepts credit cards and SSL certificates play an important role in meeting these requirements. Here are a few SSL-related issues that can cause a \u201cfail\u201d on a PCI compliance scan if they\u2019re not resolved:<\/p>\n Failing a PCI compliance audit could result in hefty monthly fines in the tens, to hundreds of thousands, possible suspension of a company\u2019s ability to handle card payments, plus leaves them more vulnerable to cyberattacks.<\/p>\n GDPR<\/strong>\u2014These new regulations took effect May 25 of this year and Gartner predicts more than 50% of companies affected still won\u2019t be in full compliance by the end of 2018. Breach penalties are steep at \u20ac20 million or 4% of annual turnover, whichever is higher. Just to put this into perspective, this would equate to $7 billion for Amazon, more than two years of profit. Plus, there may be additional fines based on the type of breach, data exposed, notification, remediation and response. And, this doesn\u2019t include irreparable damage to reputation or costs associated with insurance, legal fees and settlements. Beyond the regulation itself and possible fines, there are other considerations, including companies with partners that want to be GDPR compliant and require them to follow suit. Last, but not least, there\u2019s plain old customer trust and expectations for companies to treat their information with kid gloves. And, some of the requirements in the 99-article GDPR can only be accomplished with SSL certificates.<\/p>\n One last note about compliance. Companies are, in fact, taking it seriously and backing it with budgets according to the 2018 IDG Security Priorities Study that reports 69% of companies see compliance mandates driving spending.<\/p>\nThe SSL market continues to grow<\/strong><\/h2>\n
<\/p>\n<\/p>\n<\/p>\nA peek at 2019<\/strong><\/h2>\n
\n
\n
SSL isn\u2019t going anywhere but up<\/strong><\/h2>\n
<\/p>\nThe SSL conversation needs to be about way more than encryption<\/strong><\/h2>\n
<\/a><\/p>\n\n
![\"Ten](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/05\/TSS-Hashedout-Blog-Graphic-10.svg\")
Data Breaches<\/strong>\u2014Almost a day doesn\u2019t go by without reports of a massive data breach. Adidas (two million records compromised), Facebook (up to two billion accounts scraped)\u2014the list goes on. And, it\u2019s not just the mega brands. According to the 2018 Global Threat Report, 71% of companies report suffering at least one data breach.<\/p>\n