Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

6/9/2015
03:35 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

White House Calls For Encryption By Default On Federal Websites By Late 2016

Just 31% of federal agencies today host HTTPS websites and the Office of Management and Budget (OMB) has now given the rest of the government a deadline for doing so.

In yet another step toward making Internet encryption the new normal, the White House has instituted a new policy requiring all federal agencies to use HTTPS for their public-facing websites by the end of next year.

To date, only 31% of federal agencies run encrypted, HTTPS websites, including whitehouse.gov, cia.gov, nsa.gov, and omb.gov. Interestingly, dhs.gov and fbi.gov are among the agency websites that are not HTTPS-enabled as yet, according to a federal website that tracks and grades HTTPS adoption among agencies.

The OMB first recommended the HTTPS-only policy in draft form in March, and this week's announcement solidifies the plan with guidance and a December 31, 2016, deadline for adopting encrypted website communications via the standard.

Tony Scott, the administration's federal chief information officer, said in the new policy memorandum that all publicly accessible federal government websites and web services must deploy secure connections between the client and website via HTTPS, the Hypertext Transfer Protocol Secure.

"Private and secure connections are becoming the Internet's baseline, as expressed by the policies of the Internet's standards bodies, popular web browsers, and the Internet community of practice. The Federal government must adapt to this changing landscape, and benefits by beginning the conversion now. Proactive investment at the Federal level will support faster internet-wide adoption and promote better privacy standards for the entire browsing public," Scott said in the announcement.

"Although some Federal websites currently use HTTPS, there has not been a consistent policy in this area. An HTTPS-only mandate will provide the public with a consistent, private browsing experience and position the Federal Government as a leader in Internet security," he said.

The US government's encrypted website policy comes on the heels of a wave of SSL/TLS-related moves in the industry, including major websites including Facebook, Twitter, and LinkedIn, going encrypted in an age of privacy and security concerns. Google is even giving HTTPS sites a ranking boost. The Internet Activities Board (IAB) -- which oversees the Internet's architecture, protocols, and standards efforts, last November officially called for encryption to be instituted throughout the protocol stack as a way to secure information exchange, and provide privacy.

IAB chairman Russ Housley also urged developers to deploy encryption by default, and for network and service providers to add it as well to their offerings.

"Web security is in a dismal state," says Jeremiah Grossman, co-founder of WhiteHat Security. "This is a step in the right direction" for the feds, he says.

The catch, however, is just how such a massive number of agencies with large numbers of web pages and sites will manage their SSL/TLS certificates. It's unclear whether the feds will serve as their own certificate authority or not -- that information was not included in the policy. Efforts to reach the OMB prior to press time about the CA were unsuccessful.

"They're going to have a crypto challenge. How are they going to do key management, agency by agency? They're going to run into logistics issues, having expiring SSL keys," for example, Grossman says.

Grossman says despite the inherent challenges of getting HTTPS everywhere in the government, the new policy is a "win for everybody."

[Internet Architecture Board chairman Russ Housley explains what the IAB's game-changing statement about encryption means for the future of the Net. Read Q&A: Internet Encryption As The New Normal.]

The White House encryption policy also comes amid the backdrop of a bitter battle between the FBI and the White House with members of the technology community over backdoors to encryption for helping law enforcement fight crime and terror. Members of the Information Technology Industry Council and the Software and Information Industry Association today penned a letter to President Obama in protest of any policies that would allow for such backdoors.

No Fix For Hacks

HTTPS does not, of course, prevent website hacks or other security events -- a caveat Scott included in the OMB policy document.

"HTTPS-only guarantees the integrity of the connection between two systems, not the systems themselves. It is not designed to protect a web server from being hacked or compromised, or to prevent the web service from exposing user information during its normal operation," he said. "Similarly, if a user's system is compromised by an attacker, that system can be altered so that its future HTTPS connections are under the attacker's control. The guarantees of HTTPS may also be weakened or eliminated by compromised or malicious certificate authorities."

The administration's guidelines for HTTPS deployment calls for all new federal agency websites and services to be HTTPS from the get-go. It recommends HTTPS for intranets as well, but isn't requiring it.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
6/9/2015 | 6:38:04 PM
Apple...
in its iOS 9 dev documentation calls for HTTPS as the default. Security is improving, if slowly.
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26895
PUBLISHED: 2020-10-21
Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation (e.g., routing node, payment-receiver,...
CVE-2020-26896
PUBLISHED: 2020-10-21
Prior to 0.11.0-beta, LND (Lightning Network Daemon) had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't verify that the corresponding outgoing off-chain HTLC was already settled before releasing the preimage. In the case of a hash-and-amount collis...
CVE-2020-5790
PUBLISHED: 2020-10-20
Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
CVE-2020-5791
PUBLISHED: 2020-10-20
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.
CVE-2020-5792
PUBLISHED: 2020-10-20
Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.