RSA '07: Gates, Ellison to tout security at RSA

The annual RSA Conference, expected to draw 15,000 security professionals and more than 325 vendors from around the world to San Francisco's Moscone Center exhibit hall, kicks off this week with keynotes from industry luminaries Bill Gates and Larry Ellison.

RSA '07 HQ: Click here for complete coverage

Microsoft Chairman Bill Gates, accompanied by Craig Mundie, chief research and strategy officer, is expected to tout the security of Microsoft's new Vista operating system, plus how e-commerce can improve if Web sites make use of the industry's new Extended Validation Secure Sockets Layer (EV SSL) certificate for authentication.

The EV SSL certificate causes the visited Web site's URL address to glow green in the Microsoft Internet Explorer 7.0 browser to indicate the Web site is legitimate, not a phishing site. VeriSign and Entrust are the first public certificate issuers to make it available.

So far, few sites other than PayPal are known to be making use of the EV SSL certificates, which require the certificate issuer to go to some effort to verify the identity and business affiliation of an individual requesting one.

"We confirm every piece of information independently," says Tim Callan, director of product marketing at VeriSign, which in December began selling the high-assurance EV SSL certificates for $995.

VeriSign's more "general-purpose certificates," which don't display the green URL bar with the IE 7.0 browser and don't require the same investigative checking, cost $400. The drawback of conventional certificates is that they don't provide users with any effective warning and sometimes are issued without enough information about the certificate buyer's identity.

Callan says that while Microsoft has the first browser to support EV SSL, the Mozilla Firefox and Opera browsers are expected to support EV SSL green-light authentication.

Entrust this week plans to announce that it is selling EV SSL certificates for $495, in comparison with $159 for its standard SSL server certificate.

While certificate-issuing organizations anticipate quick adoption of the more expensive EV SSL server certificates with their antiphishing "green-light-go" feature, some e-commerce companies say they're not in a hurry to use them.

"We'll be evaluating the EV SSL certificate this year, but, no, we don't plan to use it right now," says John Millican, chief information security officer at online travel firm Expedia.

Ellison's turn

When Oracle CEO Ellison takes the stage at the RSA Conference for his keynote, his topic is expected to be identity management and Oracle's approach to providing customers with application and system-management administration, configuration, provisioning and monitoring.

In addition, Oracle plans to announce this week Oracle Management Pack for Identity Management, server-based software used for network discovery, monitoring, service-level management and configuration of Oracle and non-Oracle products, including directories, authentication servers and provisioning software.