Turns out, they can – and then some.
Certificate-related outages and downtime have been making headlines in the recent past, and for all the wrong reasons. The infamous Equifax breach, which struck all the way back in 2017, culminated in the firm having to cough up a gargantuan US$700 Million in net damages earlier this year. While this is a clear outlier, the Ponemon institute’s 2019 Cost of a Data Breach Report places designates a value of US$3.9 Million as the average cost of a small data breach, with the average climbing to as high as US$8 Million for larger breaches.
What do data breaches have to do with PKI certificates?
You might wonder where certificate management fits into the breach deterrence equation. Let’s consider Equifax’s example. The exfiltration of personal data belonging to thousands of people was made possible only because the software responsible for detecting such breaches was offline – courtesy of its x.509 certificate expiring and remaining unrenewed. Digital security protocol dictates that an expired certificate is null and void, rendering the endpoint tethered to the certificate virtually invalid. Thus, the breach went undetected for a whopping 76 days.
Could the entire fiasco have been prevented by simply renewing the certificate? It’s hard to say, but it most certainly would have helped Equifax to detect it earlier. Another question arises here: How is a security team expected to keep tabs on and periodically renew its SSL/TLS certificates when it has tens of thousands of them on file? After all, large corporations possess millions of endpoints, often across continents, with each one requiring multiple levels of certificate-related security. What’s more, there are a range of vendors (a.k.a Certificate Authorities, or CAs for short) on the market these days. Manual certificate management already looks like a nightmare, doesn’t it?
Automation prevents outages, and here’s why.
This is the part of the problem statement where certificate management solutions fit in. These tools have two principles by which they operate: automation and integration. Essentially, they’re full-cycle platforms which assist security professionals in managing their Public Key Infrastructures (PKI) by centralizing certificate and key operations, and enabling dashboard-style control via a user interface. They also feature flexible automation engines that eliminate recurring manual routines by allowing users to set up automated workflows that execute on schedule.
Now, let’s dive into the topic of discussion: How can certificate management solutions help hedge against outages? To answer this question, we’d have to define an outage. In the simplest sense of the term in this context, an outage is an event triggered by the invalidity of a digital certificate that causes systems reliant on the certificate to be rendered inactive. This event could often trigger chain reactions ranging from data breaches to application downtime, often resulting in business losses, brand damage, and alarmingly, a loss of customers.
Certificate management solutions are a necessity.
When you invest in software that acts a certificate manager, you gain access to a defined system that handles the most important aspects of the process for you, only requiring you to interface with the GUI by clicking a few buttons, at most. If you’re familiar with the SSL/TLS space, you’re probably aware that the ‘certificate lifecycle’ consists of a few integral steps:
Detection: The scanning of network environments to locate certificates, ensuring none go undocumented.
Provisioning: Pushing an issued certificate to an endpoint, which could be an application, a server, or a device.
Monitoring: Dynamically maintaining visibility into the status of certificates answers several questions at a glance. Which certificates have renewals due? Which of them have expired already?
Key Security: Safely storing private keys on file with standard, industry-grade encryption.
Renewal: Requesting CAs to renew certificates whose validities have expired, rendering them invalid.
Revocation: Replacing compromised certificates with fresh ones, usually post cipher suite updates.
Phew! That’s a lot of steps, and this cycle drives home the fact that manual management can safely be eliminated from the equation. Automated certificate management tools burrow into your network infrastructure and integrate with it, enabling security teams to manage the entire lifecycle from its interface. That’s a lot of time saved, and of course, with minimized human contact comes a reduction in the errors caused.
Given the inevitable explosion of connected devices and internet-reliant technology like the cloud and the IoT, full-cycle certificate management will soon be a staple of the industry (if it isn’t already). Security experts around the world have been advocating automation for the longest time, and with the second decade of the millenium close at hand, it’s time for enterprises to catch on. If you don’t have a certificate management tool yet, we’ll help you get started with one – AppViewX CERT+ is the market-leading certificate and PKI management platform, and it’s as easy-to-use and resource-light as enterprise software gets.
To have our team evaluate your certificate strategy and help you implement a certificate management tool to optimize your network operations, give us a call, or schedule a demo with us today.
Tags
About the Author
Nataraj Purudappa
AVP Product Management
AVP of Product Management looking in CERT+ business line.
