OpenSSL being the open source SSL implementation, has a huge market share – at least 50% of all external-facing web properties use OpenSSL in some fashion, estimates a new Forrester Research report.
The impact of Heartbleed is huge as many security pros use the secure socket layer/transport layer security (SSL/TLS) protocol to encrypt sensitive information transmitted between web servers and Internet browsers to secure eCommerce, banking, healthcare, and other high-risk transactions. Every personal and enterprise computing system that used a vulnerable version of OpenSSL at any point in time must consider its certificates compromised.
The report offers a “how to” for organizations to fix a broken OpenSSL implementation.
Here’s a quick summary of the recommendations:
- Recompile OpenSSL libraries and/or upgrade OpenSSL commercial software. The OpenSSL organization has already released a mitigation to the bug. However, the only way to fix Heartbleed is to recompile OpenSSL libraries (and then potentially recompile all your internal applications linking the fixed OpenSSL libraries) and/or upgrade OpenSSL commercial software to the newest versions that support the bug fix.
- Contact your partners, particularly your service providers. Heartbleed affects not only web applications but also hardware. Affected systems may have to be completely replaced, and perhaps more worrisome is the fact that existing equipment in retailers’ inventories may have the defect as well.
- Use existing controls to help mitigate the Heartbleed risk. For example, upgrade IPS and firewall appliances with the latest Heartbleed signature and filters.
- Be sure to scan all your assets for the vulnerability. All major vulnerability-scanning vendors are already offering updates to their products so security pros can test for the presence of the Heartbleed bug in their systems.
- At the right time, force a companywide password change. Changing passwords prior to the application of the SSL fix will still leave the user potentially vulnerable, while providing a false sense of security.
- Communicate before, during, and after the incident. There are very few organizations or individuals that have not been affected by Heartbleed, and for several days to come, it will remain a permanent fixture of the daily news cycle. Don’t keep employees and customers in the dark and wondering what, if any action, your organization is taking.
