Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Black Hat

Qualys Continues New Product Launches at Black Hat – Announces Free Online SSL Testing Tool

It has been a busy week for Qualys at Black Hat in Las Vegas. Earlier in the week the company announced the ability to include “exploitability data” its QualysGuard product.

It has been a busy week for Qualys at Black Hat in Las Vegas. Earlier in the week the company announced the ability to include “exploitability data” its QualysGuard product. On Wednesday, the company announced the launch of “BlindElephant” – an opensource tool for Web application fingerprinting.

Today, Qualys announced a free online SSL test, which examines a Web site’s SSL certificate and performs a configuration analysis to detect configuration weaknesses and performance issues. Users enter the web site domain name, and the test will assess any server behind the domain. The test results include a numerical score, grading the SSL server across several categories, as well as a letter grade that rates the SSL configuration.

A numerical score from zero to 100 and a letter grade is provided at the end of the test indicating the strength of the SSL implementation on the web site being tested. We ran the test on several popular domains and it dished out some pretty harsh grades. For example, bankofamerica.com servers scores ranged from 48 to 63. Are Bank of America’s SSL certificates really configured that poorly?

Bank of America SSL Test from Qualys

Along with the launch, the findings of research conducted over the past year studying about 120 million registered domain names using more than 800,000 SSL certificates will be presented in a live session today at Black Hat USA 2010.

SSL can often have issues, including problems with configurations and certificate validations, which render SSL useless and jeopardize online security.

Some interesting statistics on SSL:

• Only a tiny portion of all sites use SSL

• Only 70 percent of certificates are valid • Half of all sites support the insecure SSLv2 protocol

Advertisement. Scroll to continue reading.

• About 38 percent of SSL sites are well configured; 62 percent are not

• About 32 percent of sites still suffer from the renegotiation vulnerability

“SSL is a successful protocol that serves as the security backbone of the Internet, but most sites just don’t have it well configured,” said Ivan Ristic, director of engineering for Qualys and creator of SSL Labs.

To use the SSL testing tool, visit: https://www.ssllabs.com/

Written By

For more than 15 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is founder and director of several leading cybersecurity industry conferences around the world.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Discover strategies for vendor selection, integration to minimize redundancies, and maximizing ROI from your cybersecurity investments. Gain actionable insights to ensure your stack is ready for tomorrow’s challenges.

Register

Dive into critical topics such as incident response, threat intelligence, and attack surface management. Learn how to align cyber resilience plans with business objectives to reduce potential impacts and secure your organization in an ever-evolving threat landscape.

Register

People on the Move

Gigamon has promoted Tony Jarjoura to CFO and Ram Bhide has been hired as Senior VP of engineering.

Cloud security firm Mitiga has appointed Charlie Thomas as Chief Executive Officer.

Cynet announced the appointment of Jason Magee as Chief Executive Officer.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.