The Register reports that DigiCert has admitted to a security lapse lasting sixteen months, which it says exposed customer information. According to the report, the problem began during a server move that was not carried out correctly, and DigiCert took months to notice that someone had accessed the system in the meantime.
, EAC Network Solutions: DigiCert is one of the organisations that issues the SSL certificates which secure client portals, webmail and remote access systems for firms of this size, so this is worth a closer look rather than a shrug. We are not saying any particular firm uses DigiCert, or that this incident has touched anyone reading this, only that it is a question worth answering rather than assuming. If your practice runs a client portal, online banking integration or secure email gateway, find out who issued the certificate behind it and whether that supplier has said anything about this. If the answer is DigiCert, or you simply do not know, that is a conversation to have with whoever manages your IT, because a certificate authority with an extended, undetected lapse is not something to leave unchecked purely because nothing obvious has gone wrong. The lesson here is less about this one supplier and more about knowing which parts of your infrastructure depend on outside providers you rarely think about, and making sure someone is actually watching them.
Source: The Register
