\nCode signing works. Poorly implemented code signing puts your business at greater risk. In the case of SolarWinds, they were using a code signing certificate to sign the files. The problem wasn\u2019t the code signing certificate, the problem was the way they were practicing code signing.<\/p>\n<\/blockquote>\n\n\n\n
Those SolarWinds updates got pushed to nearly 18,000 customers, including Microsoft, Nvidia, Intel, and Cisco, who were suddenly left exposed via a backdoor hidden within the SolarWinds software. It\u2019s nothing new – a similar situation occurred with Asus in 2019<\/a> \u2013 and attackers will continue to attempt code tampering as long as companies are lax with their processes.<\/p>\n\n\n\n
So, what is code signing exactly? Why is it such an important part of the software development cycle? And, most importantly, what are the code signing best practices that your organization should always follow?<\/p>\n\n\n\n
Let\u2019s hash it out.<\/span><\/p>\n\n\n\n
What is Code Signing?<\/h2>\n\n\n\n
First, let\u2019s take a step back and review what code signing is and how it works. Code signing certificates help to:<\/p>\n\n\n\n
\n
- Protect your code as it\u2019s distributed online<\/li>\n\n\n\n
- Verify that you are the author of the file<\/li>\n\n\n\n
- Signal if the software has been tampered with<\/li>\n\n\n\n
- Provide a permanent, irreversible timestamp that allows for verification after certificate expiration or revocation<\/li>\n<\/ul>\n\n\n\n
Code signing uses public key infrastructure (PKI) to apply a digital signature as proof of legitimacy and integrity. Extended Validation (EV) code signing certificates<\/a> go a step further. A more vigorous verification process is carried out before certificate issuance, and the certificate itself is stored on a physical USB device as an additional layer of security. EV code signing also gets rid of Microsoft SmartScreen and other browser\/operating system (OS) warnings thanks to the higher level of identity verification that\u2019s initially required.<\/p>\n\n\n
\nWithout code signing, Windows generates the warning message on the left prior to installation. The warning goes away when a signed application is detected, as seen on the right.<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n Code signing is widely performed across all software platforms, device types, and application categories. In fact, some platforms actually make code signing a requirement for publishing.<\/p>\n\n\n\n
Why is Code Signing Important?<\/h2>\n\n\n\n
Users want to be confident when downloading a file, and if there is any doubt in their mind then they will tend to reject the software altogether. Code signing acts as a sort of \u201cdigital shrink wrap\u201d that tells the user that not only is the file coming from a verified source, but also that it hasn\u2019t been tampered with in the meantime.<\/p>\n\n\n\n
Code signing provides peace of mind and builds trust with end users, making them much more likely to install your application on their machine. It leads to more downloads, more users, and an improved reputation and brand image.<\/p>\n\n\n<\/span><\/span>\n\n\n\n
How Does Code Signing Work?<\/h2>\n\n\n\n
As we touched on earlier, code signing certificates are similar to other types of digital certificates in that they\u2019re built on PKI. Their implementation and use depends on whether we\u2019re talking about the developer or the consumer. We\u2019ll start with the developer.<\/p>\n\n\n\n
Code Signing and Developers<\/h3>\n\n\n\n
The general code signing process that\u2019s carried out during the software development cycle is typically as follows:<\/p>\n\n\n\n
\n
- The developer generates a certificate signing request (CSR) and private-public key pair.<\/li>\n\n\n\n
- The CSR (which includes the public key) is sent to the Certificate Authority (CA), who verifies the identity of the developer and issues the code signing certificate.<\/li>\n\n\n\n
- The developer hashes their code. This must be performed prior to signing. Basically, a hashing algorithm is used<\/a> (most commonly SHA-256 nowadays) to convert the code into an arbitrary, fixed value (and is a one-way process). The result of the hashing is called a digest.<\/li>\n\n\n\n
- The code signing certificate is used to create a signature block. The signature block is attached\/included with the software file.<\/li>\n\n\n\n
- The software has now been code-signed and is ready for distribution.<\/li>\n<\/ol>\n\n\n\n
Code Signing and Consumers<\/h3>\n\n\n\n
Code signing more straightforward for users. Most operating systems will check for a code signing certificate prior to software installation. When a code signing signature is detected in the application, the OS will:<\/p>\n\n\n\n
\n
- Verify the legitimacy of the certificate.<\/li>\n\n\n\n
- Use the public key from the CA to decrypt the digest.<\/li>\n\n\n\n
- Use the same hash function to generate a new digest from the code.<\/li>\n\n\n\n
- Compare the new digest with the original that was generated by the developer.<\/li>\n\n\n\n
- If they match, then it confirms that they code hasn\u2019t been tampered with.<\/li>\n\n\n\n
- The OS proceeds with installation.<\/li>\n<\/ol>\n\n\n
\nViewing the properties of a code signing certificate.<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n The Top 11 Code Signing Best Practices<\/h2>\n\n\n\n
Now that we know all about how code signing works and why it\u2019s so beneficial, let\u2019s get into the code signing best practices. These should always be used by your organization in order to maximize the effectiveness of your code signing certificates.<\/p>\n\n\n\n
1. Limit Key Access<\/h3>\n\n\n\n
\n
- Restrict access to private keys based on roles<\/li>\n\n\n\n
- Minimize the number of machines that store code signing keys<\/li>\n\n\n\n
- Minimize the number of staff members that can access the keys<\/li>\n\n\n\n
- Employ physical security controls in order to minimize key access such as key card-protected doors and locked drawers\/cabinets<\/li>\n\n\n\n
- Always keep the private key behind lock-and-key<\/li>\n<\/ul>\n\n\n\n
2. Maximize Key Security<\/h3>\n\n\n\n
\n
- Protect private keys with secure vaults and Hardware Security Modules (HSMs), which are special cryptographic processors solely designed for safeguarding keys<\/li>\n<\/ul>\n\n\n
\nAn example of a Hardware Security Module (HSM).<\/figcaption><\/figure>\n<\/div>\n\n\n \n
- Key-protection products should be at least FIPS-140 Level 2 certified<\/li>\n\n\n\n
- For transportation of private keys, use hardware that is protected with a strong password of at least 16 characters and contains uppercase and lowercase letters, numbers, and special characters<\/li>\n\n\n\n
- Ensure that private keys are never (for any reason) added to easily accessible places like GitHub, PasteBin, publicly accessible servers, etc.<\/li>\n<\/ul>\n\n\n\n
3. Perform Time-Stamping<\/h3>\n\n\n\n
\n
- Time-stamps allow for verification of code even after the original code signing certificate has expired or was revoked<\/li>\n\n\n\n
- Time-stamp certificates can be used to validate for up to 11 years after issuance<\/li>\n<\/ul>\n\n\n\n
4. Use Test-Signing Only When Appropriate<\/h3>\n\n\n\n
\n
- Test-signing certificates are either self-signed or come from an internal, private CA and should therefore only be used in a secure test environment<\/li>\n\n\n\n
- Test-signing certificates don\u2019t require the same level of security as production code signing certificates<\/li>\n\n\n\n
- Test-signing certificates cannot chain to the same root as your production certificates<\/li>\n\n\n\n
- The test-signing infrastructure should be completely separate from the production infrastructure<\/li>\n<\/ul>\n\n\n\n
5. Review Code Prior to Signing<\/h3>\n\n\n\n
\n
- Code should be thoroughly reviewed and authenticated prior to signing<\/li>\n\n\n\n
- A code signing submission and approval process should be created and used to avoid the signing of unapproved and\/or malicious code<\/li>\n\n\n\n
- All code signing activities should be logged in case of future audits or security incidents<\/li>\n<\/ul>\n\n\n\n
6. Scan First<\/h3>\n\n\n\n
\n
- It\u2019s important to remember that code signing doesn\u2019t ensure the safety of what\u2019s inside \u2013 you can code sign a virus or malware if you really wanted to<\/li>\n\n\n\n
- Be extra careful when incorporating open-source code from external sources<\/li>\n\n\n\n
- Perform virus and malware scanning prior to code signing<\/li>\n\n\n\n
- Malware scanners can\u2019t detect everything, so ensure that each code\/component change has been manually vetted<\/li>\n<\/ul>\n\n\n\n
7. Don\u2019t Rely on One Certificate<\/h3>\n\n\n\n
\n
- Using multiple certificates helps to distribute risks<\/li>\n\n\n\n
- Multiple certificates can help make it easier to track any issues that may arise<\/li>\n<\/ul>\n\n\n\n
8. Don\u2019t Hesitate to Revoke<\/h3>\n\n\n\n
\n
- Any compromised certificates should be immediately revoked and reported to the certificate authority<\/li>\n\n\n\n
- \u201cCompromised\u201d means any suspicion that the private key may have gotten into the hands of an unauthorized user, or that the certificate was used to sign an application containing malware or other malicious code<\/li>\n\n\n\n
- Use time stamps to determine the latest possible revocation date that can be used in order to minimize the impact on safe code<\/li>\n<\/ul>\n\n\n\n
9. Centralize Certificate Management<\/h3>\n\n\n\n
\n
- Certificate management platforms, such as DigiCert\u2019s CertCentral<\/a> or Sectigo Certificate Manager<\/a>, use automation to simplify the certificate management process, reduce errors, and improve security of keys<\/li>\n\n\n\n
- Continuously monitor the status of your code signing certificates, another area where certificate management platforms help \u2013 they give you visibility and can provide alerts for possible issues<\/li>\n\n\n\n
- Regularly audit key usage to ensure policies are accurate<\/li>\n<\/ul>\n\n\n
\nHow a user requests a code signing certificate within DigiCert’s CertCentral certificate management platform. <\/em><\/figcaption><\/figure>\n<\/div>\n\n\n 10. Keep Up to Date<\/h3>\n\n\n\n
\n
- Stay informed regarding any new cryptographic algorithms or industry practices to ensure you have the best available protection<\/li>\n\n\n\n
- Immediately respond if any new security flaws or vulnerabilities are discovered<\/li>\n<\/ul>\n\n\n\n
11. Create Organizational Policies and Procedures<\/h3>\n\n\n\n
\n
- Create a written policy document that everyone in the organization should follow \u2013 it should be a “living document” that adapts to any internal or external changes<\/li>\n\n\n\n
- Your code signing policy should address:\n
\n
- Who can sign code<\/li>\n\n\n\n
- What code signing tools are approved for use<\/li>\n\n\n\n
- Which kind of certificates are permitted<\/li>\n\n\n\n
- Who is the approver of code signing requests<\/li>\n\n\n\n
- How\/where private keys are stored & protected<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Train your staff on these best practices once per year<\/li>\n<\/ul>\n\n\n<\/span><\/span>\n\n\n\n
All Signs Point to Best Practices<\/h2>\n\n\n\n
As with any security measure, code signing is only as effective as its implementation and use. No company intends to fall victim to software tampering and end up like SolarWinds or Asus, but it only takes one mistake to leave yourself exposed. As Nelson of DigiCert says:<\/p>\n\n\n\n
\nFor those of you who may be down the road with some of these bad practices \u2014 stop. Get control of what you\u2019re doing and minimize the risk for your business. SolarWinds isn\u2019t the only organization with bad code signing practices \u2014 let\u2019s use this compromise to improve the way we operate and keep our businesses safe.<\/p>\n<\/blockquote>\n\n\n\n
The human element in the code signing process is most often the weak link, but technical mistakes can doom you as well. By following the best practices that we\u2019ve outlined, you can minimize risk and educate your staff about how to sign code as effectively as possible. That way, you can consistently protect your software, your customers, and the brand that you\u2019ve worked so hard to build.<\/p>\n","protected":false},"excerpt":{"rendered":"
Learn How to Keep Your Customers Safe and Your Software Tamper-Free By Using Code Signing Certificates Want to protect your home from thieves? A security system is a popular option….<\/p>\n","protected":false},"author":37,"featured_media":14374,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[25],"tags":[],"class_list":["post-14373","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ssl-certificates","post-without-tags"],"views":10596,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/04\/bigstock-Code-Html-Php-Web-Programmin-367468945.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/14373","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/37"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=14373"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/14373\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/14374"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=14373"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=14373"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=14373"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"windows](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/04\/csc1.png\")
![\"code](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/04\/csc2.png\")
![\"HSM\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/04\/csc3.jpg\")
![\"CertCentral\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/04\/csc6-1024x527.jpg\")