Endpoint

8/3/2017
05:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Symantec Sells Digital Certificate Business to DigiCert

$950 million deal comes in the wake of Google sanctions on Symantec certs earlier this year.

Symantec will sell its SSL business to DigiCert for $950 million in a move that lets the security vendor avoid the need to entirely rebuild its digital certificate issuance infrastructure following a series of punitive actions by Google earlier this year.

Under terms of the sale announced this week, in addition to the upfront cash, Symantec will also receive a 30% stake in the common stock of DigiCert.

In a prepared statement, Symantec CEO Greg Clark said the proposed sale would sharpen the company's focus on cloud security. Symantec customers meanwhile will benefit from having a company that offers a modern website PKI platform to handle their digital certificate requirements going forward, he said.

Symantec's board has approved the transaction, which is expected to formally close in the third quarter of fiscal 2018.

The proposed sale makes sense for Symantec and is consistent with the general direction in which the company has been heading recently, says Garrett Bekker, principal security analyst at 451 Research.

"Symantec has spent about $7.5 billion on acquisitions since they got rid of Veritas," and began to focus purely on the cybersecurity market, he says. "They are certainly trying to rationalize their portfolio and get rid of non-core assets."

The plan especially makes sense for Symantec considering the pressure it has been under from Google in recent months, Bekker says.

He was referring to a Google decision from earlier this year to gradually deprecate all Symantec issued digital certificates over the next several months. Google described the decision as being driven by multiple failures on Symantec's part to properly validate its digital certificates before issuance.

Google said that an investigation it conducted showed that Symantec had allowed at least four parties to access its infrastructure and issue certificates with none of the required checks and balances. Google claimed that an inquiry that began with a set of 127 Symantec issued certificates expanded to over 30,000 suspect certificates over multiple years.

Symantec's failure to properly oversee the issuance of these certificates represented a failure by the company to adhere to the standards expected of a Certificate Authority and posed a threat to Google Chrome users, Google claimed. As a result, Chrome would, in a phased manner stop trusting all existing Symantec-issued certificates Google said. Going forward, Symantec would need to replace the certificates with new fully validated ones, Google had said.

Symantec itself characterized Google's claims and misleading and grossly exaggerated. The company claimed that only 127 certificates were identified as mis-issued and not 30,000. Symantec said that Google was singling it out for blame though the mis-issuance involved multiple CAs.

Selling off the certificate business means that Symantec no longer will need to contend with the issue. But "questions about how the certificate infrastructure will evolve if the merger goes through should be uppermost in the minds of customers and partners," says Michael Fowler, president of DigiCert rival Comodo CA. What still remains to be determined for Symantec customers is how the sale will impact Google's decision to deprecate all existing Symantec SSL certificates starting October 2018, he says.

Given the problems that Google has identified with Symantec's infrastructure it is unlikely that DigiCert will use it going forward, Fowler speculates. But DigiCert, as a smaller vendor in this space, does not have the same infrastructure as Symantec, which could be problematic for Symantec's enterprise customers and channel partners, he claims.

Bekker though sees little to no complication for Symantec's customers. "I don't think [the proposed sale] will have much of an impact at all," he says.

Symantec's certificate business will immediately increase DigiCert's market share and make the company one of the biggest players in the PKI and SSL markets, Bekker says. "This will make DigiCert pretty much one of the leaders in terms of revenues," in the digital certificate business.

Related content

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Lessons from My Strange Journey into InfoSec
Lysa Myers, Security Researcher, ESET,  7/12/2018
What's Cooking With Caleb Sima
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14339
PUBLISHED: 2018-07-19
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the MMSE dissector could go into an infinite loop. This was addressed in epan/proto.c by adding offset and length validation.
CVE-2018-14340
PUBLISHED: 2018-07-19
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, dissectors that support zlib decompression could crash. This was addressed in epan/tvbuff_zlib.c by rejecting negative lengths to avoid a buffer over-read.
CVE-2018-14341
PUBLISHED: 2018-07-19
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the DICOM dissector could go into a large or infinite loop. This was addressed in epan/dissectors/packet-dcm.c by preventing an offset overflow.
CVE-2018-14342
PUBLISHED: 2018-07-19
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the BGP protocol dissector could go into a large loop. This was addressed in epan/dissectors/packet-bgp.c by validating Path Attribute lengths.
CVE-2018-14343
PUBLISHED: 2018-07-19
In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ASN.1 BER dissector could crash. This was addressed in epan/dissectors/packet-ber.c by ensuring that length values do not exceed the maximum signed integer.