Public key infrastructure (PKI) has become a critical element of digital security, but proper deployment is essential. Here Tim Callan, chief compliance officer at Sectigo, explains how to avoid potential pitfalls like certificate problems, governance problems, visibility problems, and more.
Digital certificates and other public/private key pairs permeate all corners of today’s enterprise. They enable the identity-based security approaches and encrypted machine-to-machine interactions that are essential to digital operations. The stakes are tremendous, and flawed or suboptimal public key infrastructure implementation and management can be the root cause of breaches, outages, or compliance violations at a massive scale.
Despite the technology’s critical nature, PKI-related tasks are often not viewed as a priority, assigned to non-experts without the resources, time, or executive oversight necessary to accomplish them effectively. Unfortunately, this results in PKI errors and misconfigurations, which can expose enterprise operations and digital assets to unnecessary risk.
While PKI implementation itself is important to securing the enterprise, it is equally important to ensure that PKI is implemented correctly. Below are the top five PKI pitfalls, the issues that arise within them, and how to overcome and prevent them with ease.
1. Certificate Problems
Setting up PKI systems is a marathon, not a sprint. One of the most common issues at the beginning of implementation is the use of weak keys. Unfortunately, keys that are not sufficiently strong can become a point of exposure, leading to an underlying problem to PKI implementation.Â
Another common pitfall is unnecessarily long certificate lifespans. Having to change out certificates can seem like a painful process, so there’s a human tendency to make them last as long as possible. However, a shorter certificate lifespan can shrink the attack surface through time. Rotating certificates more often ultimately leads to less risk of attack.
Like overly long certificate terms, outdated cryptographic algorithms can create long-term problems despite having an easy solution. While RSA and ECC encryption methods are effective today, they will likely be rendered obsolete by advancements in quantum computing within the next several years. Organizations like National Institute of Standards and Technology (NIST) are working on identifying new algorithms capable of standing up to both quantum computing and more traditional encryption cracking methods. IT teams should already be planning for this future, preparing to update their cryptographic methods as soon as better solutions become available.Â
Learn More: Is Public Key Infrastructure (PKI) Crucial for Securing Today’s Digital Transactions?
2. Deployment Problems
A risky behavior in certificate deployment that nonetheless is all too common is the reuse of certificates across devices. As a time and money saver, reusing certificates can be enticing to users. Unfortunately, if one certificate is bad, then all certificates are bad. Similarly, if one certificate is breached, then the potential exposure can stretch across multiple devices. Rather than trying to kill two birds with one stone, the best practice is to keep each device separate to minimize risk across devices and certificates.
Certificate automation is another key piece of the PKI implementation puzzle. Automated certificate management is essential for enterprises to protect against cyberattacks and sudden failure of critical business systems. In addition, automated PKI certificate management solutions are easy to implement and can remove the complexities associated with securing connected devices and human errors involved with risk. As the number of certificates used by the average enterprise skyrockets, manual certificate management has become untenable, with automation playing an increasingly critical role.
3. Security Problems
The most common issue in this category is the improper protection of private keys. Whether the device in question is an IoT device with a secure enclave or a laptop with a trusted platform module (TPM), it is incredibly important to ensure that private keys cannot get in the hands of anyone else. Fortunately, there are modern technologies to prevent this and ensure proper protection.
Failure to apply patches and respond to vulnerabilities is another common PKI pitfall. Unfortunately, it’s common for organizations to get a system up and running and never look back.
However, responding to vulnerabilities and applying patches should be considered another part of holistic system maintenance and given an appropriate level of attention. After all, it’s better to be proactive than reactive and face consequences later.
Learn More: 5 Reasons Organizations are Moving PKI to the CloudOpens a new window
4. Governance Problems
Enterprises can’t run like the Wild West. Without rules and guidance, teams can’t run efficiently or effectively. Unfortunately, many DevOps teams are seeing a lack of policy consistency in their organizations. This lack of uniformity can lead to further inconsistencies in PKI implementation, creating larger risks for the company. Creating rules and order is the key to preventing catastrophe, but those rules must be applied consistently. Â
Another hurdle in governance is the battle of knowing when to use public versus private roots. The wrong choice can lead to larger security risks. The key is to think through the use case to understand your specific needs in a trust model. One rule of thumb is to consider whether a browser or root store is involved. If so, public keys should be used. Otherwise, your best bet may be a private CA.
5. Visibility Problems
You can operate a successful environment without knowing what certificates you have in use. Two of the most frequent issues in visibility are rogue certificates and rogue CAs.Â
Rogue certificates are trusted certificates that are issued by a trusted CA, but are either compromised or issued to the wrong party. Allowing rogue certificates or CAs to operate in your environment without taking them under management can create a whirlwind of issues.
It can also allow attackers to create illegitimate websites that are indistinguishable from real ones. Ensuring CIOs and CISOs have sufficient visibility into any and all certificates can help enterprises avoid giving attackers this type of opening.
Learn More: Security and Speed, Two Opposing Priorities Can Co-Exist in DevOpsOpens a new window
Now What?
When implementing PKI, it’s critical not only to make a list and check it twice, but consistently revisit each step to stay on top of things and prepare for the future. While there are many potential pitfalls when implementing PKI, a proper combination of modern technology and effective education can help responsible organizations avoid any conflict or overcome them with ease.Â
Did you find this article helpful? Tell us what you think on LinkedInOpens a new window , TwitterOpens a new window , or FacebookOpens a new window . We’d be thrilled to hear from you.