There were some key takeaways from the study, one of which was simply the scope of the problem. Certificate management has become a major burden<\/a> as our digital infrastructure and the role of PKI has continued to grow. The larger an organization gets, the more acute the problem becomes. <\/p>\n\n\n\n But one of the other major takeaways is the fact that for many organizations, the biggest risk they perceive stemming from bad certificate management isn\u2019t compromise, misuse or expiration. <\/p>\n\n\n\n It\u2019s failing audits or being non-compliant. <\/p>\n\n\n\n And that begs the question, are we, as an industry, having the\nwrong conversation?<\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n\n Published just last month, KeyFactor and the Ponemon Institute created an exhaustive survey<\/a> and spoke with a range of professionals from myriad organizations to put together this information. Let\u2019s just start a little bit with the methodology before we get into the findings.<\/p>\n\n\n\n First of all, this study was conducted in the United States and consisted of 30 questions about five potential certificate management disaster scenarios (the five fingers of death). Here\u2019s the breakdown of what positions those surveyed hold in their organizations.<\/p>\n\n\n\n This survey was originally sent to over 17,000 organizations\nand was returned by just over 600. 58 of those were tossed out for various\nreasons, which means the final sample comes from 596 American organizations.\nHere\u2019s the breakdown of their size. <\/p>\n\n\n\n Ok, so with that in mind, let\u2019s look at the key takeaways from the study.<\/p>\n\n\n<\/span><\/span>\n\n\n Three out of five organizations have serious concerns about their ability to secure encryption keys during all stages of their lifecycle, from issuance to rotation, renewal and revocation. As we\u2019ve discussed before, at its heart SSL\/TLS is really just an elaborate digital mechanism for exchanging the encryption keys<\/a> we\u2019ll use to communicate with the websites or end points we visit. Strip away all of the other terminology and what you are doing every time a handshake<\/a> takes place is authenticating the other party so you can use their public key to encrypt a session key (or the secret that will lead to its generation) so you can communicate securely.<\/p>\n\n\n\n Obviously, that\u2019s just in the context of SSL\/TLS, but encryption keys are also used for a number of other purposes like signing email, documents, software, etc. <\/p>\n\n\n\n We cover the risks of key compromise <\/a>all the time because it\u2019s a fairly common threat. This underscores the fact that many organizations view it the same way. But there do seem to be some things holding many organizations back from improving their certificate and key management practices:<\/a> cost.<\/p>\n\n\n\n Per the study:<\/p>\n\n\n\n Most organizations do not have adequate IT security staff to maintain and secure keys and certificates, especially in the deployment of PKI. Further, most organizations do not know how many keys and certificates that IT security needs to manage. <\/p>\n<\/blockquote>\n\n\n\n So, it\u2019s partly a lack of qualified personnel. But that\ncosts money. Additionally:<\/p>\n\n\n\n Pricing models can prevent organizations from investing in solutions that cover every identity across the enterprise. <\/p>\n<\/blockquote>\n\n\n\n That\u2019s why it\u2019s generally better to work with an SSL service instead of trying to go direct from a CA, but what would we know\u2026<\/a><\/p>\n\n\n\n Anyway, the financial concerns don\u2019t end there. This is taken from a part of the survey that dealt with organization\u2019s perceptions of PKI and certificate management in general, it asked respondents to respond with their level of agreement about a given statement from Strongly Agree to Strongly Disagree. Clearly, cost is a major concern:<\/p>\n\n\n\n We actually deal with quite a few Enterprise clients, not every PKI and certificate management solution is cost-prohibitive. In fact, some are quite budget-friendly<\/a>. And we\u2019ve actually got a white paper coming out on Certificate Management best practices next month (so keep an eye out). <\/p>\n\n\n\n Here\u2019s a look at the percentage of organizations that are outsourcing all or part of their Public Key Infrastructure deployment. <\/p>\n\n\n\n This is one of the ways we\u2019re probably missing the target as an industry, because the perception of certificate management is that it\u2019s expensive and complicated. It doesn\u2019t have to be<\/a>. And in the long run, it\u2019s not a sunken cost \u2013 it\u2019s an investment<\/a>. Because as we\u2019re about to unravel, the costs associated with mismanaging certificates is staggering. <\/p>\n\n\n\n But, before we go any further, let\u2019s take one more chance to identify the scope of the problem we\u2019re talking about. Of the nearly 600 respondents, this was the average number of certificates and keys owned by each one (per the survey\u2019s extrapolation).<\/p>\n\n\n\n As organizations grow larger, certificate and key management become exceedingly difficult. There comes a point where you either need to hire dedicated staff to handle it or you need to outsource it to a third-party security company that knows how to handle it for you. <\/p>\n\n\n\n Doing anything else is just inviting trouble.<\/p>\n\n\n\n And, as we touched on at the start of this section: 61% of these organizations don\u2019t have confidence they can secure these keys and certificates for the entire duration of their lifecycle. Organizations need to be proactive about this before it comes back to bite them.<\/p>\n\n\n\n Let\u2019s talk about what kind of trouble you may be inviting by\nnot being proactive with your certificate management policies.<\/p>\n\n\n<\/span><\/span>\n\n\n Indulge me the Kung Fu header while we talk about the five\nnightmare scenarios that this survey presented:<\/p>\n\n\n\n This is where things take an interesting turn, and it goes back to whether we\u2019re having the right conversations as an industry – this is how the organizations surveyed view these threats. On a scale of one to five, with five being the most sever, Failed audits\/non-compliance is number one by a wide margin. That shows that for most organizations, data security and secure connections are nice ideals, but where rubber meets the road is in terms of maintaining compliance with industry standards and legal regulations. <\/p>\n\n\n\n There\u2019s a good chance a lot of this stems from the GDPR<\/a>, which went into effect last year and threatens massive penalties<\/a> for organization\u2019s that fail to comply.<\/p>\n\n\n\n In that sense, the security is a means to an end. The end being compliance. Organizations are less interested in the actual security benefits than they are in maintaining compliance and avoiding the fines and penalties that come with running afoul of that<\/a>. <\/p>\n\n\n\n There\u2019s an old anecdote about a salesman who sells drill bits and over time realizes that his customers could really care less about the details of the drill bits themselves \u2013 what they want is a quarter-inch hole. That\u2019s their interaction with the product. What we might be missing is that for many organizations, their quarter-inch hole isn\u2019t cybersecurity at all, that\u2019s a secondary concern to compliance. <\/p>\n\n\n\n But despite the decided advantage failed audits\/non-compliance have in terms of the severity they\u2019re perceived with, they cost organizations about the same as any of the other four certificate\/key management disasters.<\/p>\n\n\n\nThe Impact of Unsecured Digital Identities<\/h2>\n\n\n\n
![\"Positions](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/02\/Certificate-Managment-1.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/02\/Certificate-Managment-2-1.png\")
<\/figure>\n\n\n\n61% of Organizations Are Concerned They Can\u2019t Secure Keys Through All Stages of the Lifecycle<\/h2>\n\n\n
![\"Lock](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/02\/Hashed-Out-Encryption-Icon-300x300.jpg\"){kind=icon}
<\/figure>\n<\/div>\n\n\n\n
\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/02\/Certificate-Managment-3.png\")
<\/figure>\n\n\n\n![\"mPKI](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/02\/Certificate-Managment-4.png\")
<\/figure>\n\n\n\n![\"Average](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/02\/Certificate-Managment-5.png\")
<\/figure>\n\n\n\nThe Five Fingers of Death<\/h2>\n\n\n\n
\n
<\/p>\n\n\n\n![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/02\/Certificate-Managment-6.png\")
<\/figure>\n\n\n\n
![\"Biggest](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/02\/Certificate-Managment-7.png\")
<\/figure>\n\n\n\n![\"Who](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/02\/Certificate-Managment-8.png\")
<\/figure>\n\n\n\n![\"Hashed](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/08\/bigstock-222348568-1024x267.jpg\")
<\/figure>\n","protected":false},"excerpt":{"rendered":"