By: Sergey Yasa
Submitted: 2010-02-04 15:32:41 | Word Count: 459
Using SSL to secure all websites could appear like an odd selection; most websites contain no "nuggets" price taking, SSL apparently slows the page load time (particularly on over provisioned hosting platforms), and it isn't clear if doing therefore can kibosh any search engine optimizations.
Back when I worked at the Bank, I tried to advance the thought that every page should be SSL protected however a number of these same arguments were thrown back to me - “why will it matter if we have a tendency to don’t encrypt the communications when someone looks for ATM locations?” or “this can totally throw off our gomez rating”. I swear that Gomez is law-of-unintened-consequences accountable for why the majority of banks proffer the less-secure pratice of putting the unencrypted login page on their main home page - they will do so without compromising the load-time of their web site when measuring the speediness of their own web site against those of their peers. It’s nice to determine that some firms (thanks, Fidelity!) are coming around and enforcing the use of SSL for their entire website.
[ advertisement ]
Oops - I got abstracted. The reason why I like that this blog uses SSL is easy and at one in all my core philosophies - what you are doing on the net should be your own business, and internet sites should facilitate your maintain this level of confidentiality. Even if every web site used (and protected) their own self-signed certificates, users could still profit from the data that whatever they were doing on the web site wasn't visible to others. In fact, everyone would need to click "OK" on the certificate error pages, but that behavior already appears well established.
As abundant as I'm for doing this on my very own blog, I also administer content-filtering for a medium-sized financial services company -- protecting every website with SSL would render the majority of most content filtering applications to straightforward IP-based mostly rules, or cause management to implement transparent proxy technologies that would end in very important SSL-protected traffic being visible to a few staff (for which I wouldn't subject myself or my workers to that liability). Additionally, content-filtering systems would likely fail to handle giant hosted environments with shared IP addresses.
Therefore - toolsets would need to evolve to deal with a brand new "always confidential" internet. This includes Google AdWords, that has nonetheless to support SSL websites. Google Analytics still works - but that is a privacy issue, and not a confidentiality one. :)
Author Resource:-
Learn more about modern it audit tools at the blog of professional IT Auditor at itechaudit.com
