How web traffic can still bypass my firewall

Even though you may be paying for your firewall, sixty percent of internet traffic is bypassing it without being scanned, potentially containing malicious content like malware. The reason for this is something called SSL (Secure Sockets Layer) encryption, a measure that is supposed to be protecting your data, not putting it at risk.

What is SSL encryption?

To understand why this is occurring, you will need a basic understanding of exactly what SSL is and what it does.

If a website has a URL beginning with https instead of http, it has an SSL certificate. The SSL certificate originated with websites requiring online payment as it secures data transfer, meaning that any information transferred would be readable only by the recipient. It meant that hackers could not read your credit card information when you made a purchase.

Why is this a problem?

Your firewall probably cannot read and filter the traffic on any website that has an SSL certificate. Unless you are willing to spend more to get a more modern, sophisticated firewall, your device is at risk of being plagued with malware from websites you expect to be more secure than their http counterparts.

This becomes even more worrying when you realise that literally any website can purchase an SSL certificate, and not just trustworthy domains. The only advantage that an SSL actually has is that cyber criminals cannot access data being sent to and from the website.

How google is contributing to this

SSL is being promoted by Google, despite it’s faults.

Google Chrome, the most popular and widely used browser, warns users when they try to visit websites without an SSL certificate, promoting the idea that if your website doesn’t have one, it’s unsafe. Websites are also prevented from using certain features if they don’t have an SSL certificate, including Adwords, Shopping and Remarketing, meaning that you have no choice but to get a certificate if you want to use them. Additionally, Google announced, back in 2014, that they will also give ranking boosts to websites that are SSL enabled.

Because Google prioritises sites with the certificate, you have no real choice but to get an SSL if you want your business or website to become well-known. Due to this, the amount of sites with SSL certificates has increased enormously.

How safe are SSL certified websites?

Regardless of the content of the website or the intent of it’s creator, any site can acquire an SSL certificate.

This means that even if you are visiting a website that appears to be safe and has an SSL, it is potentially still dangerous, with the only advantage offered by the SSL being that no one but the site owner can view what information is being transferred.

There have also been cases of sites with an SSL that make them appear legitimate being infected with malware, meaning that visitors are infected by a website they assumed was safe.

Cyber criminals only have to add a small amount of dangerous code to well-known websites in order to entice visitors to click on disguised links. Malicious data can then be downloaded onto your system as long as the site is SSL certified, because your firewall is prevented from scanning it to ensure that it is safe.

We are always up to date and aware of any established or emerging cyber threats, and focus on keeping our customers as safe as possible from cyber threats at all time.