The content of this book expresses the views and opinions of the author in understanding and establishing an additional security layer for your website. It is designed to provide information and practices for understanding and implementing a Secure Socket Layer.
The author uses various service providers as examples in this book, but these mentions do not intend an endorsement or guarantee of services.
This book is not intended or should be taken as legal advice. This book and its author only intend on providing self-help information understanding the usage, procedure, and implementation of a Secure Socket Layer.
This book is not a substitute from consulting with a security expert or a person who understands proper installation procedures when required.
This book does not come with any warranty or guarantee and the author cannot be held liable for any damages that may or may not result from negligence from any party.
Part 1: Understanding SSL
An Introduction
It does not matter if you are an individual, business, or organization, you have to approach online security in the same way that you would approach physical security. At your home you have locks, alarms, and other measures to prevent intruders from entering. At a business there are similar and likely stronger measures of physical security.
Understanding the need for physical security is easy. There is a threat that is visible. When it comes to online security and overall data security most people miss the target. There are many reasons for this. With a home intruder, you see the threat, but an online intruder can often go undetected. The treat of online theft is real, but rarely acknowledged. Technology also advances very quickly. Individuals and businesses who try to keep up with data and online security can easily be unaware of the latest security measures that are needed.
Most individuals and business owners think that it would never affect them. In February 2015, there was well over a billion stolen from a hundred different banks. The funds were stolen digitally and not by intruders taking hostages and demanding money. In my personal opinion the threat of online theft or intrusion is much more likely than the possible physical threat.
In this short book my objective is to explain one aspect of online security; the Secure Socket Layer. Technology can be confusing and almost magical in away. If this book helps just one detangle the confusion, then I am successful in my mission.
In this book we will use several terms, which should be outlined now. These will help you understand the context of my writing even if you are not familiar with technology or information systems. These terms can be defined further, but my goal is to explain them as non-technical as possible.
Client: An individual who is visiting a website
Host: The system or server that a website is housed on
Encrypt: To conceal and convert data into a cipher or code
Decrypt: Encrypted information being made readable
Browser: A program used to display websites
SSL: Secures data between a client and host
What is a Secure Socket Layer
SSL, used frequently in this book, stands for Secure Socket Layer. An SSL provides an additional level of security to websites. Essentially what it does is creates a secure connection between the client and the host so that information sent between the two is encrypted and secured. The secure layer starts when a client enters a website into their browser and connects to the host.
For example, if I open up the website for M&T Bank, I can see that the traffic is secured. All information send from my computer (Client) to the M&T Bank site (Host) is encrypted as it moves through the web to each point. When the client or the host receives data it is then decrypted so it is readable.
While the information travels it is encrypted and if anyone would scrape the data, it would be in an unreadable format. This is because of the secure layer of communication, which is established by the SSL.
For there to be a secure connection established, the host must have a SSL Certificate installed. This certificate is a small piece of code that performs two functions.
The first function the certificate does is provides information about the identity of a business, website, or individual to verify the authenticity of the site. This information is displayed when you launch a website with a padlock symbol. If you click on that padlock it will provide you with details about the certificate issuer and holder. The highest trusted level of SSL authentication is the Extended Validation SSL. Those can be more costly and take more time to get established. For an organization or business like a bank or online store, it tells visitors that they when through an extended verification process.
The second function is processing data encryption. This function allows information and communication to be transferred over the internet between client and host, without being able to be intercepted by a malicious party. Only the intended recipient (client or host) of the information will be able to read it.
Think of this like going to the airport. If you are going to travel you need a passport, which is a metaphorical SSL Certificate. It is issued by a trusted authority, in this instance the government. There are strict rules on who can and cannot obtain one. When the traveler (host with a certificate) reaches security (client), the information is presented, verified, and passage permitted.