The need to enforce HTTPS for web applications
Learn about the Cyber Security Bureau’s latest recommendation
Message from the Cyber Security Bureau on recommendation to use HTTPS protocol
The Cyber Security Bureau is recommending enforcing the use of HTTPS (i.e., HTTP protocol protected with TLS encryption) for all services made available to outside organizations using HTTP. The obligation applies to courts and DIRS (Department of Information Technology and Court Records). The recommendation has been given the character of a standard to be implemented by 31.12.2022.
The legitimacy of introducing HTTPS in services operating inside these organizations was also given for consideration.
Why use HTTPS?
It is recommended to use HTTPS for services that process special category data, such as personal data, login credentials for IT systems. Unlike HTTP, HTTPS has security through an additional layer of encryption, such as TLS.
The use of HTTPS makes it possible to:
- verify the identity of the site to which the user logs in (preventing attempts at impersonating sites),
- securing data from being intercepted or modified by third parties during transmission,
- increase the level of privacy (anonymous exchange of data between users and the website),
- increase user confidence in the site.
Use of HTTPS in the eAuditor system
With every eAuditor deployment, we recommend the use of HTTPS to secure the login data to the administration console. In a situation where network administrators are unable to generate a certificate themselves – our technical support department strives to support customers at every stage.
However, there are times when, during a call with customers, our technical support engineers see that there is no certificate installed – despite the options available to generate one. With this in mind, we would like each of our customers to comply with the requirement set by the Cyber Security Bureau. To this end, we have prepared a special instruction available here. If you have additional questions, please contact your mentor.
We handle cyber security issues as a priority!
You may be interested in
NIS2 #2: Blocking websites
NIS2 #2: Blocking websites Find out how to [...]
DORA regulation – What is it and what challenges does it bring?
DORA Regulation What is it and what challenges [...]
Whistleblower vs informer
Whistleblower vs informer The difference that matters [...]
