In March 2015, Ponemon Institute published a report that analyzed business failures associated with a lack of trust in the security of a company’s keys and certificates. The report states that of 2,300 participants from enterprises around the world, 54% admit to having a lack of policy enforcement and remediation for keys and certificates. Likewise, 54% of security professionals say they don’t even know how many keys and certificates they have, where they are located, or how they are used.

Secure keys and certificates are anchors for maintaining enterprise reputation, customer confidence, and overall security. If the anchor points of a company prove to be weak, the implications can be enormous.

The Implications of Unsecure Keys

Unauthorized users who gain access to private keys can pose as the keys' legitimate owner, obtain the trust of innocent clients, and reap the benefits of fraudulent phishing attacks. Servers use private keys every time a SSL Certificate transmits and receives sensitive information. If hackers gain access to a private key, they can decrypt a client's shared keys and unlock data transmitted and sent by the server, additionally breaking any company PCI-DSS agreements and GLBA compliance. In the event of compromised keys, customer loss, tainted brand image, and lost revenue or expense are a few of the many possible consequences obtained from unprotected company keys.

Private keys are installed with each individual digital certificate. Without management tools, administrators can easily lose track of the thousands of keys and certificates they own. With every compromised key, each platform, application, or service associated with that key requires a new key and certificate. Replacements can be very costly and time-consuming, requiring more than 20 manual steps to update a single certificate. However, companies can avoid these costs by taking the right steps to protect their keys and certificates and facilitate greater security and integrity.

Best Practices

Protecting company keys and certificates should be a priority for all businesses. A few practices companies can implement regularly to close security gaps and fend off compromise include the following:

Use the principle of least privilege—Implement multi-factor authentication for access to the system and network, blocking all but the most necessary network ports. Install all available security updates and run an antivirus scanner. Separate test signing and release signing—Test your code when it’s signed by setting up a parallel code-signing infrastructure that uses test certificates generated by an internal test root certificate authority. Store keys in a secure cryptographic hardware device—Keys stored in software on general-purpose computers are susceptible to compromise. Cryptographic hardware devices are less vulnerable and are trusted for the most critical applications.

Monitoring the trustworthiness of keys and certificates and remediating any vulnerabilities make it difficult for attackers to take control of company systems and networks. As Ponemon reports, “Organizations need to initiate processes and technologies that allow them to gain complete visibility into their key and certificate inventory and apply policies that comply with regulatory, industry, and internal governance standards – avoid outages and compromise.”