TLS certificates: what they are and how they affect IT security

The acronym for Transport Layer Security, guarantee the identity of the website, thus protecting it against possible phishing attacks

Theft of credentials for social networking sites, email and home banking; ransomware infections; spied smartphones and stolen data. These are just a few of the cyber threats that threaten our privacy and personal data while surfing the web almost every day.

And although they may seem detached from each other, they have the same source: in the vast majority of cases, attacks result from a perfectly orchestrated social engineering campaign. Whether it’s a phishing campaign or spam doesn’t really matter: hackers use the information we sowed here and there while surfing the web to trick us into their trap. Without our knowledge, we end up installing a Trojan horse, rootkit or worse, ransomware.

What are TLS certificates

For several years, more and more websites have been implementing TLS certificates in their infrastructure (short for Transport Layer Security and the successor of SSL certificates, currently considered unsafe). These are security tools that guarantee the “identity” of a website and ensure that the connection used is encrypted and protected. TLS certificates, mainly used by home banking and email portals, social networks, and generally by all parties that require authentication, are able to protect against phishing attacks.

The integration of TLS certificates with the communication protocols used in the network made browsers show users whether a given site is trustworthy or not, based on the “certificate” of Transport Layer Security. After confirming that the desired portal is actually being visited, the browser displays a padlock to the left of the URL (or the words “Secure” in Chrome), followed in some cases by the name of the portal operator.

How TLS Certificates Work

The TLS protocol used to secure connections between internet servers and end users consists of two parts: the first is for authenticating the page you want to visit; the second for encrypting the connection and data exchanged between two network nodes. It is in the first phase that TLS certificates appear.

Provided and authenticated by third parties (so-called certifying), TLS certificates are required by the browser when a user requests access to domain resources (e.g. image, text or login page). After receiving the certificate, the browser makes sure that the signature on the certificate is genuine and that it actually matches the signature in the database of the certifying entity, so that it can assume that the site it is going to visit is trustworthy. In short, an actual identity check is performed with the TLS / SSL certificate acting as an identification document.

Protection offered by TLS certificates

Thanks to the way they are designed and implemented, TLS certificates are an ideal weapon against phishing attacks. By showing the user that they are actually accessing their bank’s website or logging into an email portal (and not an identical website with a similar but significantly different URL), they are able to recognize the cyber fraud and escape before the hacker can take their valuable assets. credentials.