ENCRYPTION, SSL, CERTIFICATES RACHEL AKISADA & MELANIE KINGSLEY

OVERVIEW Encryption Encryption example SSL How SSL Works SSL Certificates How to get a Certificate Man in the Middle Attacks

ENCRYPTION Best way to ensure data security Also referred to as cipher text Not easily understood by anyone other than authorized parties Main purpose is to protect confidentiality of digital data Key Elements Authentication Integrity Non-repudiation

HISTORY OF ENCRYPTION Ancient Greeks Used scytale to encrypt their messages Caesar’s Cipher Shifted letters left or right by a certain number of characters WWII Enigma machine Cracked by the Polish Modern Encryption Symmetric encryption Asymmetric encryption

EXAMPLE OF ENCRYPTION

SSL Secure Sockets Layer Establishes an encrypted link between the browser and the website Used to secure transactions, logins, and data transfers Ensures data is private and integral Prevents eavesdropping

SSL CERTIFICATES Also known as Digital Certificates Used to establish a secure encrypted connection between browser and server Three keys Public Private Session Anything encrypted with the public key can only be decrypted with the private key

KEYS Public key - A publicly viewable key Private key - Only viewable by the owner Encrypting and decrypting take a lot of processing power Creates a symmetric session key during “SSL Handshake” The session key is used to encrypt all transmitted data

HOW TO GET A SSL CERTIFICATE Create a Certificate Signing Request on your server Creates a private key and public key on your server Install the SSL Certificate on your server Digitally signed by a trusted Certificate Authority DigiCert GoDaddy Pay $300 annual fee

CERTIFICATE AUTHORITY Entity that issues digital certificates Responsible for making sure website is valid Top Certificate Authorities by market share, 2016 Comodo - 40% Symantic - 26% GoDaddy - 11% GlobalSign - 9%

SSL HOW IT WORKS

MAN IN THE MIDDLE ATTACKS Also referred to as MITM or MIM Cyber attack where a malicious actor places themselves into a conversation Tries to impersonate both parties to gain information Might happen on Financial sites Connections meant to be secured by public or private key Sites that require login where there is information to be gained

MAN IN THE MIDDLE ATTACKS

OTHER FORMS OF MITM ATTACKS Evil Twin Rogue wifi network that appears to be legitimate When the user joins the attacker uses a MITM attack to intercept data Sniffing Uses software to intercept data being sent from, or to, your device