Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Black Hat

Qualys Continues New Product Launches at Black Hat – Announces Free Online SSL Testing Tool

It has been a busy week for Qualys at Black Hat in Las Vegas. Earlier in the week the company announced the ability to include “exploitability data” its QualysGuard product.

It has been a busy week for Qualys at Black Hat in Las Vegas. Earlier in the week the company announced the ability to include “exploitability data” its QualysGuard product. On Wednesday, the company announced the launch of “BlindElephant” – an opensource tool for Web application fingerprinting.

Today, Qualys announced a free online SSL test, which examines a Web site’s SSL certificate and performs a configuration analysis to detect configuration weaknesses and performance issues. Users enter the web site domain name, and the test will assess any server behind the domain. The test results include a numerical score, grading the SSL server across several categories, as well as a letter grade that rates the SSL configuration.

A numerical score from zero to 100 and a letter grade is provided at the end of the test indicating the strength of the SSL implementation on the web site being tested. We ran the test on several popular domains and it dished out some pretty harsh grades. For example, bankofamerica.com servers scores ranged from 48 to 63. Are Bank of America’s SSL certificates really configured that poorly?

Bank of America SSL Test from Qualys

Along with the launch, the findings of research conducted over the past year studying about 120 million registered domain names using more than 800,000 SSL certificates will be presented in a live session today at Black Hat USA 2010.

SSL can often have issues, including problems with configurations and certificate validations, which render SSL useless and jeopardize online security.

Some interesting statistics on SSL:

• Only a tiny portion of all sites use SSL

• Only 70 percent of certificates are valid • Half of all sites support the insecure SSLv2 protocol

• About 38 percent of SSL sites are well configured; 62 percent are not

• About 32 percent of sites still suffer from the renegotiation vulnerability

“SSL is a successful protocol that serves as the security backbone of the Internet, but most sites just don’t have it well configured,” said Ivan Ristic, director of engineering for Qualys and creator of SSL Labs.

To use the SSL testing tool, visit: https://www.ssllabs.com/

Written By

For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.

Click to comment

Expert Insights

Related Content

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

Cyberwarfare

Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Audits

Out of the 335 public recommendations on a comprehensive cybersecurity strategy made since 2010, 190 were not implemented by federal agencies as of December...

Cybersecurity Funding

Forward Networks, a company that provides network security and reliability solutions, has raised $50 million from several investors.

Network Security

Cisco patched a high-severity SQL injection vulnerability in Unified Communications Manager (CM) and Unified Communications Manager Session Management Edition (CM SME).

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...

Cybersecurity Funding

Network security provider Corsa Security last week announced that it has raised $10 million from Roadmap Capital. To date, the company has raised $50...