Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/3/2017
05:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Symantec Sells Digital Certificate Business to DigiCert

$950 million deal comes in the wake of Google sanctions on Symantec certs earlier this year.

Symantec will sell its SSL business to DigiCert for $950 million in a move that lets the security vendor avoid the need to entirely rebuild its digital certificate issuance infrastructure following a series of punitive actions by Google earlier this year.

Under terms of the sale announced this week, in addition to the upfront cash, Symantec will also receive a 30% stake in the common stock of DigiCert.

In a prepared statement, Symantec CEO Greg Clark said the proposed sale would sharpen the company's focus on cloud security. Symantec customers meanwhile will benefit from having a company that offers a modern website PKI platform to handle their digital certificate requirements going forward, he said.

Symantec's board has approved the transaction, which is expected to formally close in the third quarter of fiscal 2018.

The proposed sale makes sense for Symantec and is consistent with the general direction in which the company has been heading recently, says Garrett Bekker, principal security analyst at 451 Research.

"Symantec has spent about $7.5 billion on acquisitions since they got rid of Veritas," and began to focus purely on the cybersecurity market, he says. "They are certainly trying to rationalize their portfolio and get rid of non-core assets."

The plan especially makes sense for Symantec considering the pressure it has been under from Google in recent months, Bekker says.

He was referring to a Google decision from earlier this year to gradually deprecate all Symantec issued digital certificates over the next several months. Google described the decision as being driven by multiple failures on Symantec's part to properly validate its digital certificates before issuance.

Google said that an investigation it conducted showed that Symantec had allowed at least four parties to access its infrastructure and issue certificates with none of the required checks and balances. Google claimed that an inquiry that began with a set of 127 Symantec issued certificates expanded to over 30,000 suspect certificates over multiple years.

Symantec's failure to properly oversee the issuance of these certificates represented a failure by the company to adhere to the standards expected of a Certificate Authority and posed a threat to Google Chrome users, Google claimed. As a result, Chrome would, in a phased manner stop trusting all existing Symantec-issued certificates Google said. Going forward, Symantec would need to replace the certificates with new fully validated ones, Google had said.

Symantec itself characterized Google's claims and misleading and grossly exaggerated. The company claimed that only 127 certificates were identified as mis-issued and not 30,000. Symantec said that Google was singling it out for blame though the mis-issuance involved multiple CAs.

Selling off the certificate business means that Symantec no longer will need to contend with the issue. But "questions about how the certificate infrastructure will evolve if the merger goes through should be uppermost in the minds of customers and partners," says Michael Fowler, president of DigiCert rival Comodo CA. What still remains to be determined for Symantec customers is how the sale will impact Google's decision to deprecate all existing Symantec SSL certificates starting October 2018, he says.

Given the problems that Google has identified with Symantec's infrastructure it is unlikely that DigiCert will use it going forward, Fowler speculates. But DigiCert, as a smaller vendor in this space, does not have the same infrastructure as Symantec, which could be problematic for Symantec's enterprise customers and channel partners, he claims.

Bekker though sees little to no complication for Symantec's customers. "I don't think [the proposed sale] will have much of an impact at all," he says.

Symantec's certificate business will immediately increase DigiCert's market share and make the company one of the biggest players in the PKI and SSL markets, Bekker says. "This will make DigiCert pretty much one of the leaders in terms of revenues," in the digital certificate business.

Related content

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Florida Town Pays $600K to Ransomware Operators
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/20/2019
Pledges to Not Pay Ransomware Hit Reality
Robert Lemos, Contributing Writer,  6/21/2019
AWS CISO Talks Risk Reduction, Development, Recruitment
Kelly Sheridan, Staff Editor, Dark Reading,  6/25/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12888
PUBLISHED: 2019-06-26
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-12887. Reason: This candidate is a reservation duplicate of CVE-2019-12887. Notes: All CVE users should reference CVE-2019-12887 instead of this candidate. All references and descriptions in this candidate have been removed to preve...
CVE-2019-12280
PUBLISHED: 2019-06-25
PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path Element.
CVE-2019-3961
PUBLISHED: 2019-06-25
Nessus versions 8.4.0 and earlier were found to contain a reflected XSS vulnerability due to improper validation of user-supplied input. An unauthenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a users browse...
CVE-2019-9836
PUBLISHED: 2019-06-25
Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) 0.17 build 11 and earlier has an insecure cryptographic implementation.
CVE-2019-6328
PUBLISHED: 2019-06-25
HP Support Assistant 8.7.50 and earlier allows a user to gain system privilege and allows unauthorized modification of directories or files. Note: A different vulnerability than CVE-2019-6329.