News release: “If you’re thinking “Heartbleed” sounds serious, you’re right. But it’s not a health condition. It’s a critical flaw in OpenSSL, a popular software program that’s used to secure websites and other services (like VPN and email). If your company relies on OpenSSL to encrypt data, take steps to fix the problem and limit the damage. Otherwise, your sensitive business documents and your customers’ personal information could be at risk. About two-thirds of all web servers use OpenSSL, so it’s safe to say the small coding error recently discovered by researchers has big implications. The error, which has been in place for over two years, makes it possible for a hacker to grab information that’s supposed to be protected. Vulnerable web servers can be tricked into revealing random bits of data over and over, until the hacker gets something juicy, like the server’s encryption key. Armed with the encryption key, a hacker can monitor all communication to and from a server — including usernames, passwords, and credit card information — or create a fake version of a trusted site that would fool browsers and users, alike. Worse yet, the hacker leaves no trace, so it’s nearly impossible to know the extent of the damage caused by Heartbleed.  What can you do? Talk to your IT staff to find out if your websites, networks, or other applications use OpenSSL. Remember that even if your public website isn’t vulnerable, you might have other applications that are — like your email server. There are details about the problem and the solution at heartbleed.com. If you have systems that are affected, here are some steps to discuss and implement with your IT team:

1. Update to the newest version of OpenSSL and reboot servers.
2. Generate new encryption keys according to your systems’ instructions.
3. Get a new SSL Certificate from a trusted certificate authority to signal to web browsers that your site is safe and secure.
4. Notify your employees and customers. Once your systems have been secured, tell your employees and customers to change their passwords for any system that was affected. If they use the same passwords on any other sites, they should change those, too.”