Bewältigung von PKI-Herausforderungen in der Finanzdienstleistungsbranche

Wie Keyfactor die Cybersicherheit, Agilität und Skalierbarkeit für M&T Bank und EQ Bank verbesserte

Banking and financial services data are among the most sensitive and confidential that an individual or an organization has. The industry ‌must recognize the responsibility it has to its users, evaluate all potential cybersecurity weaknesses, correct any deficiencies, and remain vigilant on potential risks. Empowering security teams with strong, agile certificate management systems is essential for the growth of any financial organization, but what happens when that growth outpaces its team’s ability to manage certificates? MT&T Bank and EQ Bank turned to Keyfactor to unlock the answer to this question.

Modernisierung der kundenorientierten Lösungen der MT&T Bank

M&T Bank is a community-driven bank headquartered in Buffalo, New York with over $155 billion in assets. Since its founding in 1856, the company has consistently delivered its clients’ community-driven solutions, which have naturally evolved over the last 165 years, just as M&T Bank has. Modern banking security requires agility and a commitment to improving its digital footprint, and M&T Bank has embraced the challenge.

Die Zukunft im Blick, ohne die Gegenwart zu stören

M&T first modernized its public key infrastructure (PKI) in 2010, kicking off its engagement with Keyfactor, and the bank remains consistently dedicated to providing the most trustworthy and secure solutions for its users. The relationship with Keyfactor flourished further as M&T’s certificate volume for new devices and workloads began to increase rapidly.

Keyfactor Command

When M&T implemented Keyfactor Command in 2014, it provided its security teams with heightened visibility of their certificate inventory and created an alert system to remind users to renew expiring certificates. M&T upgraded these capabilities as Keyfactor Command evolved to include network discovery, APIs, and self-service enrollment.

Vorteile einer agilen PKI

• Eliminated certificate blind spots: The cloud-based certificate monitoring and auditing solution provided M&T Banks with better visibility, allowing its cybersecurity teams to identify unauthorized certificates in their network. The comprehensive view of all active certificates, along with Keyfactor Orchestrator features like network scanning, allowed teams to locate certificates based on ownership, expiration, and location. Keyfactor helped M&T Bank locate and remove 50% of the self-signed certificates from their environment and significantly reduce their rates of error.
• Streamlined processes: M&T Bank has separate teams for administering externally trusted SSL/TLS certificates and the internal PKI. Although this is common in the industry, Keyfactor integrated with Entrust CA to give cybersecurity teams a seamless experience for certificate enrollment and lifecycle management. As a result, the cybersecurity team can organize certificates more effectively, notify application owners before their certificates expire, and tag each certificate with unique metadata, enhancing their capacity to track important information.
• Instead of running into policy barriers and chasing down developers and system administrators, M&T’s development and operations teams can issue certificates with ease by using the Keyfactor Swagger API interface.
• Improved scalability: The efficiency and scalability of Keyfactor Command has helped M&T Bank streamline its certificate management. The bank has more than 350,000 certificates, including certificates for auto-enrollment, mobile devices, web servers, networks, and cloud infrastructure.

Rationalisierung des cloudbasierten Bankensystems der Equitable Bank

Founded over 50 years ago, Equitable Bank manages more than $40 billion in assets while serving more than a quarter-million Canadians. Equitable Bank launched Canada’s first digital bank, EQ, Bank in 2016. By challenging the relevance of conventional brick-and-mortar banks, the branchless, entirely cloud-based EQ banking system grew dramatically, which raised internal questions about the stability of EQ’s infrastructure. 

EQ fehlten die für die Verfolgung von Zertifikaten erforderlichen Prozesse und Verfahren. Abgesehen von einigen Tabellenkalkulationen gab es keine interne Nachverfolgung von Zertifizierungsstellen, und das Unternehmen war hauptsächlich auf einen Ad-hoc-Mechanismus angewiesen, mit dem die Eigentümer von Anwendungen Zertifikate anfordern und ausstellen konnten. Die IT- und Infrastrukturteams stellten wahllos Zertifikate in Entwicklungsumgebungen aus. Dies machte es EQ verständlicherweise schwer, internen Prüfern Berichte vorzulegen, und schränkte die Fähigkeit ein, die Integrität der ausgestellten Zertifikate im gesamten Unternehmen zu gewährleisten. Ohne einen Prozess, der nachverfolgte, wie Teams im gesamten Unternehmen Zertifikate ausstellten, kam es bei EQ zu einer Zunahme unerkannter und nicht verfolgter Zertifikatsabläufe. Jedes Mal, wenn dies geschah, destabilisierte es die Anwendung und lenkte wichtige Ressourcen von ihrem regulären Arbeitsablauf ab, um den Ausfall zu beheben.

Zentralisierte Lösungen

Das EQ-Infrastrukturteam benötigte eine Lösung, die die Funktionen einer starken internen CA für die Ausstellung von Zertifikaten bot und gleichzeitig den Aufwand für deren interne Erstellung und Wartung überflüssig machte. Das Sicherheitsteam benötigte einen zentralen Überblick über öffentliche und private Zertifikate, um den IT-Bestand effektiv zu überwachen und zu verwalten. Systemadministratoren und Programmierer benötigten eine unkomplizierte Methode zur Verwendung von Zertifikaten und zur Kommunikation mit automatisierten DevOps-Technologien wie Azure Key Vault, Kubernetes und Istio Service Mesh. 

Only Keyfactor could fully manage and host a certificate authority and a full certificate lifecycle automation solution in a single cloud platform while delivering the most comprehensive set of APIs and integrations, allowing EQ’s DevOps teams to get started using them right away.

Verbesserte Arbeitsabläufe mit modernisierter PKI

Die Einrichtung der neuen internen Zertifizierungsstelle von EQ hatte höchste Priorität. Mit der Unterstützung von Keyfactor Command und Keyfactor PKIaaS konnte EQ in allen Bereichen Verbesserungen erzielen. 

• Shifted PKI to the Cloud: Standardizing the issuance and provisioning of certificates allowed EQ to concentrate on proactive workflows, security, software delivery, and infrastructure domains while feeling confident that Keyfactor was looking after the PKI. Developers and engineers reduced the hours they normally spent seeking and deploying security-approved certificates to just a few minutes, thanks to DigiCert and the self-service Keyfactor Command.
• Gained complete visibility to remediate risk: Keyfactor provided full visibility of all active certificates by scanning the CA databases in DigiCert CertCentral and their current on-premise ADCS installation. This made it possible to find all internal and external certifications via the network. Security engineers no longer have to worry about misidentified, out-of-date, or questionable certificates that could jeopardize the availability of EQ’s apps thanks to a full inventory of certificates.
• Eliminate outages with automation: EQ successfully reduced the rate of human error and eliminated outages using a combination of expiration alerts and automated renewal workflows, saving its IT department from needlessly hiring two full-time team members to concentrate on manual certificate-related tasks like troubleshooting errors and resolving frequent outages. To automate the provisioning and renewal processes in an Azure Key Vault environment, Keyfactor specifically configured the Keyfactor Orchestrator. This automates the renewal process and replaces expired certificates with those from EQ’s updated PKI.
• Integrated certificate provisioning with DevOps workflows: The DevOps teams at EQ used Keyfactor’s extensive API and reference tools to connect with current infrastructure and toolkits. They authenticated all certificate-based identities to ensure safe and secure communications. The DevOps team automated the issuance and rotation of certificates for HTTPS encryption and ingress points across their deployments of Azure Kubernetes Service (AKS), Istio service mesh, and Docker containers using Keyfactor. The cumulative effect of these integrations improved agility and reduced downtime.

Sicherung des Bank- und Finanzwesens mit Keyfactor

Die Cybersicherheitsteams der M&T Bank und der EQ Bank können potenziell problematische Zertifikate dank verbesserter Zertifikatstransparenz, gestraffter Prozesse, strategischer Integration und Automatisierung mit einer aktualisierten PKI und Keyfactor Command leichter erkennen und korrigieren. Dies erhöht erfolgreich die Sicherheit und verringert das Risiko von Ausfällen. Anstatt Fehler übereilt zu beheben, können sich die Teams auf die Optimierung der Benutzerfreundlichkeit konzentrieren.  

Keyfactor understands just how high the stakes are in the financial industry when it comes to securing digital identity. Find out how the Keyfactor platform can modernize your PKI, prevent certificate outages, accelerate DevOps security, and more. Request a demo today.