Heartbleed Could Cost Millions, Could Have Been Prevented

Early estimates of HeartbleedEUs cost to enterprises are running in the millions. Revoking all the SSL certificates the bug leaked will come at a hefty price, according to CloudFlare, a Web hosting service provider.

Indeed, CloudFlare insists the revocation process for SSL certificates is far from perfect and imposes a significant cost on the InternetEUs infrastructure. After completing the process of revoking and reissuing all the SSL certificates it manages for its customers, the company measured a clear spike in bandwidth due to the exercise. CloudFire estimates overall costs could run into the millions, based on its own experience.

EUGlobalsign, who is CloudFlare's primary CA partner, saw their Certificate Revocation List (CRL) grow to approximately 4.7MB in size from approximately 22KB on Monday,EU CloudFlareEUs Matthew Prince wrote in a blog post. EUThe activity of browsers downloading the Globalsign CRL generated around 40Gbps of net new traffic across the Internet. If you assume that the global average price for bandwidth is around $10/Mbps, just supporting the traffic to deliver the CRL would have added $400,000 to Globalsign's monthly bandwidth bill.EU

It Could Have Been Prevented

We turned to Richard Kenner, co-founder and vice president of AdaCore, a software solutions provider for Ada, which is a programing language designed for large, long-lived applications where security is critical, to get his take on lessons learned so far from this costly bug. He pulled back the lens and asked a significant question: Why are these things still happening?

First, letEUs look at what he means by EUstill.EU He reminded us of the incident just over a month ago where a bug in the same type of software affected Apple devices. He also pointed to a glitch two years ago that caused a Wall Street trading firm to lose $440 million in 30 minutes. And, he noted, almost every...

Comments are closed.