The Hidden Threats of Security CertificatesBy Frank Ohlhorst | Posted 2012-12-04 Email Print
Until the Flame malware incident, many IT leaders had been unaware of a hidden danger in their security infrastructure: ineffective certificate management.
These issues can be categorized in the following ways:
· Businesses do not know how many certificates they have and where they are located. This makes it difficult to manage them.
· A number of organizations specify secure encryption standards, defining the strength of the key and the encryption algorithm. Too often, IT security professionals cannot determine the strength of the encryption key—whether it is 1024 or 2048 bits long.
· SSH (Secure Shell) keys allow users to log onto Unix and Linux systems by remote access. A number of internal auditing organizations are looking at the risks of SSH.
Encryption Keys a Threat
Over the last 16 years, certificate use has exploded, and certificates are used both externally and internally, such as on routers and within software. That amplifies the management problem, especially since certificates and associated encryption keys are manually managed. What’s more, encryption keys pose as much of a threat to security as ill-managed certificates.
With encryption keys, data is encrypted and decrypted using a two-part sequence. A private key encrypts the data, while a public key (used by the recipient) decrypts the data. Simply put, these keys can unlock confidential data, so they must be secured.
In a survey of 471 senior managers by certificate management vendor Venafi, 54 percent of respondents admitted that their organizations had experienced either stolen or unaccounted for encryption keys. IT managers, CTOs and CIOs have gone to great lengths to better secure their systems and protect data, with mixed results: Intrusions still occur and seem to be on the upswing.
Gartner, in it’s “X.509 Certificate Management: Avoiding Downtime and Brand Damage” research report, offers advice about certificates. “Organizations with roughly 200 or more documented X.509 certificates in use are high risk candidates for unplanned expiry and having certificates that have been purchased but not deployed. They must begin a formalized discovery process immediately.”
· “Automated certificate discovery and renewal/management work to minimize the risk of unplanned expiry. Manual or automatic certificate management should be leveraged to attribute accountability and ownership of X.509 certificates within organizations.”
· “Organizations need to create an inventory of X.509 certificates and certificate issuers to minimize the impact and downtime in the event of a certificate issuer compromise, suspected compromise or attack as seen over the past 18 months involving several certificate authorities. Furthermore, organizations need to plan for and practice what they will do in the event of a certificate authority compromise in the context of a security incident.”
Protecting enterprises from security breaches and downtime related to security issues comes down to proactive management, peppered with common sense and situational awareness. Organizations that choose to effectively manage security technologies will be better equipped to deal with the next generation of attacks and threats.