Scribd
Upload
49 views12 pages

SSL y Protocolos de Seguridad

SSL is a protocol used to establish an encrypted connection between a client and server. It allows sensitive information to be transmitted securely. There are several vulnerabilities that can exploit SSL, such as POODLE and BREACH attacks, which force connections to use outdated, less secure versions of SSL. Organizations can reduce risks by disabling SSL compression and outdated SSL/TLS versions. SSL certificates are issued by certification authorities to authenticate servers and encrypt data in transit. Cloudflare and other services provide automated SSL certificates for multiple domains.

Uploaded by

frida ortiz
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
49 views12 pages

SSL y Protocolos de Seguridad

SSL is a protocol used to establish an encrypted connection between a client and server. It allows sensitive information to be transmitted securely. There are several vulnerabilities that can exploit SSL, such as POODLE and BREACH attacks, which force connections to use outdated, less secure versions of SSL. Organizations can reduce risks by disabling SSL compression and outdated SSL/TLS versions. SSL certificates are issued by certification authorities to authenticate servers and encrypt data in transit. Cloudflare and other services provide automated SSL certificates for multiple domains.

Uploaded by

frida ortiz
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 12

SSL Protocol

Luis Jacobo Leyva


Frida Rubi Ortiz Mendoza
SSL Protocol
From a technical point of view, the SSL protocol is a transparent method of establishing a secure
session that requires minimal intervention by the end-user.

The SSL protocol is used between the application layer and the transport layer.
Vulnerabilities
POODLE attack vulnerability

The POODLE attack (which stands for "Padding Oracle On Downgraded Legacy
Encryption", CVE-2014-3566) is a "middle man attack" (MITM) exploit that allows
an intruder to decrypt selective content within the session SSL.

Variations of the vulnerability affect TLS because an active MITM attack can force
the browser to downgrade the session to SSLv3, which can be attacked.
Vulnerabilities

This vulnerability can be detected through scripts that can be downloaded at


https://nmap.org/nsedoc/scripts/ssl-poodle.html

Through OWASP Broken Web Apps.

The best we can do is disable the SSL 3.0 immediately. And by the way, disable
version 2.0, which is still older and it is not necessary to use it.
Vulnerabilities

BREACH attack vulnerability

The BREACH attack is indifferent to the version of the SSL / TLS protocol used and is effective
against any type of cipher suite.

In practice, if you inject plaintext into an HTTPS request and look at the length of compressed HTTPS
responses, an attacker can iteratively guess and obtain plaintext secrets from an SSL stream
transmission.
Vulnerabilities

It can be detected with a web application firewall that enables deep packet
inspection of HTTP / S traffic to identify and protect against SQL injection attacks,
site script filters, and other common cyberattacks.
This through Kona Site Defender from the Akamai company.
Vulnerabilities

According to Omar Santos, Incident Manager at Cisco, there are several ways for
organizations to reduce the risks associated with BREACH. One option is to disable
HTTP compression, although Santos cautioned that doing so could negatively affect
the performance of the web application.
How does SSL work?
Certificate
SSL Certificates are issued by companies or security services accredited for this on the network, known
as Certification Authorities (CA) or you can get it for free from Let's Encrypt - Free SSL/TLS
Certificates.
1. Choose the right SSL certificate for your site and needs
2. Generate CSR (certificate signing request). You need to fill in all your information correctly so
that the CA can verify your details and issue SSL certificate promptly.
3. Finish the Order Process. Your CA will send you an order confirmation email once you've
completed the orde
4. Complete the Vetting Process. After the CA receives your order, it reviews your certificate and
conducts a vetting process.
5. Installation. After you've successfully gone through the authentication process, the CA will send

your certificate files via email. You must download them and follow up with its installation based
on your server.
SSL & CLOUDFLARE
1. Cloudflare SSL operates in different modes depending on the level of security required
and the amount of configuration you want to do.
2. Cloudflare automatically provides SSL certificates shared by multiple customer
domains.
SIMILARITIES BETWEEN SSL AND TLS
1. Used to authenticate and encrypt data transfer on the Internet.
2. Both include a public key and a private key that authenticate your server and allow your
server to encrypt and decrypt data
3. You must install a certificate on your server
Cost to obtain an SSL certificate
The price can range from $ 10 to $ 300 per year. Everything will depend on the brand,
validation and the level of security you require

You might also like