Despite the biggest search engines and browser developers saying they will stop supporting websites using SHA-1 certificates next year, 35% of companies are still using them.
Research by Venafi Labs revealed up to 61 million websites will be affected, with Chrome, Firefox and Edge all displaying messages saying the websites are unsecure when a user attempts to access them.
Other things users may experience include the websites not displaying properly, as browsers strip out non-secure elements, no green padlock appearing and in extreme cases, the websites may be blocked.
"Our whole online world is predicated on the system of trust that is underpinned by these certificates; organisations have an obligation to ensure that this is fixed," commented Kevin Bocek, chief security strategist at Venafi.
"Leaving SHA-1 certificates in place is a like putting up a welcome sign for hackers that says, We don't care about security of our applications, data, and customers."
The reason browser developers are planning to block access to sites using the outdated SHA-1 protocol is the certificates can be easily manipulated by hackers. For example, they can be intercepted and then used to launch man-in-the-middle attacks using TLS connections.
The more secure SHA-2 certificates are more robust, but it would seem some companies are holding back from updating their site security.
"The average organization has over 23,000 keys and certificates and most organizations don't have the tools or visibility to find all the SHA-1 certificates in their environment," Bocek added.
"This means migration to SHA-2 can be complex and chaotic, and, as a result, many businesses have just stuck their heads in the sand. Unfortunately, in January there will be nowhere for these businesses to hide. My advice is to get a plan in place now because it will be even more difficult to fix after the deprecation deadline when things start to break."
Responses to cyber attacks are too reactive. Learn how to monitor and tackle threats to your business much more swiftly by downloading this Intel whitepaper.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Mozilla patches high-severity security flaws in new ‘speedy’ Firefox releaseNews Numerous vulnerabilities across Mozilla's products could potentially lead to code execution and system takeover
-
Mozilla and Brave release one-click method for online privacy requestsNews Mozilla, Brave and other online privacy leaders have released a streamlined way to protect your privacy
-
Mozilla uses emoji to teach about encryptionNews The company is dedicated to educating the public about the importance of a secure internet
-
Firefox 5 set for June launchNews Mozilla ramps up its release schedule to get the next browser version launched as soon as possible.
-
Apple Safari hacked in matter of secondsNews Security researchers also take control of Internet Explorer 8 and Firefox in the space of a day for a hacking contest - which Microsoft supports.
-
New banking threat disguised as Firefox add-onNews A dangerous piece of malware can disguise itself as a legitimate Firefox app.
