Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

2/23/2012
03:41 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Survey: Post-It Notes, Spreadsheets Used To Manage Digital Certificates

More than half have incomplete or inaccurate inventory of their certs, new Osterman-Venafi report finds

Certificate authorities (CA's) are still reeling from the wave of hacks against them over the past year. And it turns out their most of their customers are struggling to keep on top of their SSL certificates despite the increased threats. A new survey found that 54 percent of organizations say they don't have a complete or correct accounting of their SSL certificates, and 44 percent manage their lifecycle manually -- with Post-It notes and spreadsheets.

Michael Osterman, president of Osterman Research, which was commissioned by key management vendor Venafi to conduct the survey, says he was shocked by the lack of a sense of urgency about properly managing and protecting digital certificates. "Organizations are already behind in properly managing their certificate population via manual policies. With the expected growth in certificates, we anticipate more incursions, certificate breaches and other risks than we saw in 2011," he said in a statement.

The survey of 174 IT and IT security pros had several red flags about digital certificate management. Some 72 percent of organizations don't have an automated process in place in case their CA is hacked, so they can't automatically replace digital certificates. The risk there, of course, is a website or application outage in the event of an expired certificate.

Many (46 percent) can't even generate a report on digital certificates that are about to expire; it's a manual process to track certs that are reaching their expiration date.

"The survey confirmed our suspicions" based on what we've seen out there, says Jeff Hudson, CEO of Venafi. "People don't know what the hell's going on out there [with their certificates]."

One insurance company Venafi had worked with said they had 5,000 digital certificates, but when Venafi surveyed their inventory, they actually had twice that many. "The survey mirrors the real-world of what we see," he says.

Nearly 45 percent say they were worried about their lack of an automated certificate replacement process but haven't yet revisited the issue. Some 17 percent say they have re-evaluated this process in case of a CA emergency.

Some 70 percent of the respondents say their encryption systems are not integrated with the corporate directory, and 43 percent say they have no policy on encryption-key lengths, certificate validity periods, or private-key administration. Meanwhile, 76 percent say their digital certificate use will increase this year.

Venafi today also released a free tool for organizations to run a check on their digital certificate inventory called Assessor that scans an organization's network for digital certificates and their encryption keys, and offers remediation recommendations. It's a software module that runs in a virtual machine environment.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MS8699
50%
50%
MS8699,
User Rank: Apprentice
2/27/2012 | 7:38:30 AM
re: Survey: Post-It Notes, Spreadsheets Used To Manage Digital Certificates
The survey of 174 IT and IT security pros had several red flags about digital certificate management.
YRAV000
50%
50%
YRAV000,
User Rank: Apprentice
2/24/2012 | 5:47:54 AM
re: Survey: Post-It Notes, Spreadsheets Used To Manage Digital Certificates
IT managers using post-it notes and spreadsheets to manage millions of security instruments.
Georgeken
50%
50%
Georgeken,
User Rank: Apprentice
2/24/2012 | 5:09:02 AM
re: Survey: Post-It Notes, Spreadsheets Used To Manage Digital Certificates
Ya it's true ,its so difficult to keep track of it and the content here was good stuff
JonathonT
50%
50%
JonathonT,
User Rank: Apprentice
2/24/2012 | 3:31:58 AM
re: Survey: Post-It Notes, Spreadsheets Used To Manage Digital Certificates
I generally keep track of encryption keys with a key manager like GNU Privacy Assistant, passwords and other important phrases and small details with a password manager like PasswordSafe or Seahorse. As far as keeping track of SSL certificates and when they expired, most organizations I worked with would let the expiration pass by, and then they would have to scramble to get a new key. On the other hand, some of the bigger, Fortune 100-type companies that I worked with would keep track of the dates, and would be able to send out notifications and replacement keys as much as a month in advance. Kudos to those companies. What's the best scheduled solution for watching for expiration dates and sending automated reminders? Exchange? Sharepoint? A long-dormant cron job? Calendar reminders? I'd like to hear from workers at companies that track these reminders, and find out how they do it, and if there is anything they'd do differently to do it even better. I'd also like to hear from anyone else on their ideas for best-practice solutions and standardized software for the job.

--- Jonathon

cloudfilesecurity.biz
BDouglas
50%
50%
BDouglas,
User Rank: Apprentice
2/23/2012 | 10:54:05 PM
re: Survey: Post-It Notes, Spreadsheets Used To Manage Digital Certificates
Organizations need to quickly come to terms with how crucial encryption keys are to safeguarding the entire enterprise.
It's pure madness that large Fortune 500 companies are still using home-grown, manual processes to inventory and monitor encryption assets.-
Not only are all the recent security hacks a warning to the wise, but just the operational and compliance benefits alone are worth looking into an automated solution like this.
Bprince
50%
50%
Bprince,
User Rank: Ninja
2/23/2012 | 10:36:09 PM
re: Survey: Post-It Notes, Spreadsheets Used To Manage Digital Certificates
Very difficult to keep track of certs without some sort of tool...
Brian Prince, InformationWeek/Dark Reading Comment Moderator
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-22675
PUBLISHED: 2021-05-07
The affected product is vulnerable to integer overflow while parsing malformed over-the-air firmware update files, which may allow an attacker to remotely execute code on SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, C...
CVE-2021-22679
PUBLISHED: 2021-05-07
The affected product is vulnerable to an integer overflow while processing HTTP headers, which may allow an attacker to remotely execute code on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, CC13X2 and CC26XX SDK v...
CVE-2020-14009
PUBLISHED: 2021-05-07
Proofpoint Enterprise Protection (PPS/PoD) before 8.17.0 contains a vulnerability that could allow an attacker to deliver an email message with a malicious attachment that bypasses scanning and file-blocking rules. The vulnerability exists because messages with certain crafted and malformed multipar...
CVE-2021-21984
PUBLISHED: 2021-05-07
VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point. A malicious actor with network access may exploit this issue causing unauthorised remote code execution on vRealize Business for Cloud Virtual Appliance.
CVE-2021-26122
PUBLISHED: 2021-05-07
LivingLogic XIST4C before 0.107.8 allows XSS via feedback.htm or feedback.wihtm.