Ferguson et all share that “A PKI is a Public-Key Infrastructure. It is an infrastructure that allows you to recognize which public key belongs to whom” (Ferguson, Kohno, & Schneier, 2010). The benefits of using PKI are that two unknown parties, who trust a separate third party can have reasonable assurance that the other is who they say they are as validated by the third party. A common usage of PKI today are for proving to a customer that the website they have connected to is in fact the same as the one they believe they are connected to, and that the connection is secure. One well-known PKI infrastructure based third party system often used for web servers for SSL/TLS certificates are those offered by Digicert Inc. as the Certificate Authority (Digicert Inc., 2019). They have an excellent reputation and excellence in service and I have had excellent personal experience with this company as well as validation by external entities including TechRadar (Pickavance, 2019). Additionally, email servers and DNS servers can use digital certificates from Digicert, or other Certificate Authorities (CA), for third party assurance of secure email and DNS security (e.g. DNSSEC).
When it comes to PKI, the private keys and certificates must be strictly controlled and managed, this is why reputation is everything in the certificate authority business. Also, there is a life-cycle to the certificates private keys. They must be created, certified, distributed, used, and expired (Ferguson, Kohno, & Schneier, 2010, p. 297). The creation, distribution and use of the private keys is often handled by a controlled and limited number of network and/or system administrators who are exerpienced and trustworthy. Preferably they have had background checks and utilize smartcards to use privileged accounts (administrators, domain administrators, and root). To further reduce risks of individuals mishandling keys, privileged account holders should take annual training in the proper usage of privileged accounts. Additionally, to distribute new private keys it is recommend that at least two or more persons install and validate the handling and distribution and installation of new keys, as well as the destruction of expired keys.
The risks with the theft of private keys used to validate email, DNS, and web servers are serious, in that their theft allows the potential to steal sensitive data, produce legitimate looking DNS zone transfers, as well as manufacture entirely legitimate phishing emails and web sites to steal user data or trick users into sending sensitive data. Therefore, all systems holding private keys must be hardened, monitored and audited daily for anomalies and other discrepancies in well defined security policies.
References
When it comes to PKI, the private keys and certificates must be strictly controlled and managed, this is why reputation is everything in the certificate authority business. Also, there is a life-cycle to the certificates private keys. They must be created, certified, distributed, used, and expired (Ferguson, Kohno, & Schneier, 2010, p. 297). The creation, distribution and use of the private keys is often handled by a controlled and limited number of network and/or system administrators who are exerpienced and trustworthy. Preferably they have had background checks and utilize smartcards to use privileged accounts (administrators, domain administrators, and root). To further reduce risks of individuals mishandling keys, privileged account holders should take annual training in the proper usage of privileged accounts. Additionally, to distribute new private keys it is recommend that at least two or more persons install and validate the handling and distribution and installation of new keys, as well as the destruction of expired keys.
The risks with the theft of private keys used to validate email, DNS, and web servers are serious, in that their theft allows the potential to steal sensitive data, produce legitimate looking DNS zone transfers, as well as manufacture entirely legitimate phishing emails and web sites to steal user data or trick users into sending sensitive data. Therefore, all systems holding private keys must be hardened, monitored and audited daily for anomalies and other discrepancies in well defined security policies.
References
- Digicert Inc. (2019). SSL Digital Certificate Authority - Encryption & Authentication. Retrieved April 20, 2019, from Digicert: https://www.digicert.com/
- Ferguson, N., Kohno, T., & Schneier, B. (2010). Cryptography engineering: design principles and practical applications. Indianapolis, IN: Wiley Pub., Inc.
- Pickavance, M. (2019, March 28). Best SSL certificate services to buy from in 2019: Get the cheapest price today. Retrieved April 21, 2019, from TechRadar: https://www.techradar.com/news/best-ssl-certificate-provider