IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

35% of websites still rely on weak SHA-1 encryption

Google, Microsoft and Mozilla will stop supporting unsecure sites by the end of 2017

A padlock on a motherboard surrounded by keys

Despite the biggest search engines and browser developers saying they will stop supporting websites using SHA-1 certificates next year, 35% of companies are still using them.

Research by Venafi Labs revealed up to 61 million websites will be affected, with Chrome, Firefox and Edge all displaying messages saying the websites are unsecure when a user attempts to access them.

Other things users may experience include the websites not displaying properly, as browsers strip out non-secure elements, no green padlock appearing and in extreme cases, the websites may be blocked.

"Our whole online world is predicated on the system of trust that is underpinned by these certificates; organisations have an obligation to ensure that this is fixed," commented Kevin Bocek, chief security strategist at Venafi.

"Leaving SHA-1 certificates in place is a like putting up a welcome sign for hackers that says, We don't care about security of our applications, data, and customers."

The reason browser developers are planning to block access to sites using the outdated SHA-1 protocol is the certificates can be easily manipulated by hackers. For example, they can be intercepted and then used to launch man-in-the-middle attacks using TLS connections.

The more secure SHA-2 certificates are more robust, but it would seem some companies are holding back from updating their site security.

"The average organization has over 23,000 keys and certificates and most organizations don't have the tools or visibility to find all the SHA-1 certificates in their environment," Bocek added.

"This means migration to SHA-2 can be complex and chaotic, and, as a result, many businesses have just stuck their heads in the sand. Unfortunately, in January there will be nowhere for these businesses to hide. My advice is to get a plan in place now because it will be even more difficult to fix after the deprecation deadline when things start to break."

Responses to cyber attacks are too reactive. Learn how to monitor and tackle threats to your business much more swiftly by downloading this Intel whitepaper.

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Recommended

Google urges Apple to embrace RCS as standard, ditch SMS for Android texts
Mobile

Google urges Apple to embrace RCS as standard, ditch SMS for Android texts

10 Aug 2022
Microsoft blocking Tutanota users from Teams registration, claims fix unfeasible
Business operations

Microsoft blocking Tutanota users from Teams registration, claims fix unfeasible

8 Aug 2022
Google and SkyWater partner on open source chip design platform
Hardware

Google and SkyWater partner on open source chip design platform

29 Jul 2022
Google reveals new office in Atlanta and $1 million in funding for local communities
Careers & training

Google reveals new office in Atlanta and $1 million in funding for local communities

28 Jul 2022

Most Popular

Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022
Microsoft successfully tests emission-free hydrogen fuel cell system for data centres
data centres

Microsoft successfully tests emission-free hydrogen fuel cell system for data centres

29 Jul 2022