Vous avez des indicateurs PKI ? Voici les plus importantes que vous devez connaître.

Si vous avez passé un peu de temps sur le site PKI , vous avez probablement beaucoup entendu parler de l'agilité cryptographique ces derniers temps, mais qu'est-ce que cela signifie vraiment ? 

L'agilité cryptographique consiste à adapter les éléments de votre programme PKI , tels que les algorithmes de signature et les forces des clés, pour tenir compte des évolutions à venir. Par exemple, on parle beaucoup en ce moment de se préparer à l'informatique quantique, ce qui implique de mettre à jour et de renforcer vos clés pour qu'elles restent conformes aux normes en constante évolution. 

En fin de compte, l'agilité en matière de crypto-monnaies se résume à quatre domaines critiques : 

1. Assurer la visibilité de l'ensemble de vos clés et certificats
2. Contrôler ces éléments pour s'assurer qu'ils sont conformes aux bonnes politiques.
3. Automatisation du renouvellement des certificats pour éviter les pannes par rapport aux renouvellements manuels manqués
4. Orchestrer ces polices et renouvellements à travers toutes vos différentes chaînes d'outils DevOps ou pipelines en intégrant des solutions comme Istio et HashiCorp.

Tous ces domaines sont importants, mais la visibilité est le point de départ le plus important. En effet, si vous ne connaissez pas l'état de votre cryptographie, les opérations PKI deviennent extrêmement difficiles. En ce qui concerne la visibilité, voici les dix mesures les plus importantes à suivre.

1) Statut d'expiration

What to track: Gaining visibility into every certificate’s expiration status, including when they’re going to expire and who needs to be notified before that happens, can make an enormous difference for your PKI program. Otherwise, you run the risk of network outages, and that risk only multiples alongside the growing number of identities in the enterprise.

Why to track it: Expiring certificates are the leading reason organizations start doing certificate lifecycle management, particularly when an outage reinforces the importance of these activities.

Importantly, expired certificates can lead to more than just outages. In this example, the company had an expired certificate on a server that was monitoring network traffic. Because the certificate expired, it wasn’t reporting the data exfiltration that released customers’ personally identifiable information onto the internet. Once the company replaced the certificate (which took about 19 months past its expiration), they started seeing that theft. This is an example where the certificate didn’t cause an outage and, due to a lack of visibility into expiration status, the company didn’t immediately notice anything wrong.

How to track it: The best way to get visibility into expiration status is through a report that gives an overview of all your certificates and when they are going to expire, that way you can prioritize which ones you need to take action on. This visibility also gives you a chance to plan for the renewals that will take more time (e.g. in cases where you don’t know who’s in charge of a certificate or you don’t know how to replace it on the application that’s using it).

2) Taille et force de la clé

What to track: Understanding the size and strength of all your keys and certificates is also essential. Having this visibility can help you determine if your keys are weak and avoid becoming vulnerable to an attack as a result.

Why to track it: Every time we experience advances in computing, the algorithms behind cryptographic keys need to evolve. And given how often this happens, it’s important to make sure you can adapt key size and strength quickly, with minimal disruption to your existing infrastructure.

En outre, une clé très faible peut indiquer que vous disposez d'une clé si ancienne qu'elle n'est peut-être même plus utilisée, étant donné que de nombreuses applications refusent tout simplement les certificats basés sur des normes aussi basses. Par conséquent, le suivi de la taille et de la force des clés peut également aider à identifier les cas de prolifération.

How to track it: The ideal report for this metric evaluates key size and strength to provide an overview of where you may have vulnerabilities. For example, is the issue that your key strength is too low or is it that you have a weak signing algorithm? The answers to these questions should offer insight into where you need to adjust your settings to maximize the strength of your keys so that you don’t have to update them again in a short time frame.

3) Algorithmes de signature

What to track: Signing algorithms are the foundation of trust and security for PKI. Similar to key size and key strength, it’s essential to track signing algorithms and prepare for migration if the algorithm will be deprecated. 

Un exemple bien connu est la migration de SHA-1 à SHA-2. À l'époque, même si l'algorithme de signature SHA-1 était obsolète, de nombreuses applications n'étaient pas encore en mesure d'utiliser les nouveaux certificats SHA-2, de sorte que ces projets de migration ont nécessité une approche très réfléchie, basée sur les applications qui consommaient ces certificats.

Why to track it: Even though larger hashes are generally more secure as they’re less vulnerable to collision attacks, the definition of larger constantly changes. For instance, right now we’re waiting for advice from NIST around quantum cryptography and quantum computing. Something could happen tomorrow that requires us to apply changes quickly, and we need to be prepared for that.

Dès que quelqu'un mettra la main sur un ordinateur quantique capable de casser les algorithmes SHA-2, tout le monde devra réémettre des certificats avec un algorithme beaucoup plus puissant. Il est donc essentiel de pouvoir suivre ce qui a été mis à jour et d'automatiser le remplacement de ces algorithmes rapidement à grande échelle (à l'adresse Keyfactor, nous avons réémis et déployé des millions de certificats en 24 heures).

Il est intéressant de noter que nous trouvons parfois des dispositifs IoT conçus sans tenir compte de l'agilité cryptographique, car les certificats ont une durée de vie de 20 ans et toute mise à jour nécessite d'aller manuellement sur chaque dispositif et de remplacer le certificat. Non seulement cela représente un coût énorme, mais les changements d'algorithmes au fil du temps rendront ces appareils extrêmement vulnérables.

How to track it: The most helpful reports look at how many applications have been migrated, how many haven’t been migrated and what’s needed to get those remaining ones migrated. In cases like the SHA-1 to SHA-2 migration, which centered around applications’ inability to consume the updated signing algorithm, this report is also valuable in helping application owners understand what security updates they need to make.

4) Délivrance d'une autorité de certification (AC)

What to track: It’s essential to know all of the certificate authorities (CAs) your organization uses (both public and private) and to keep tabs on the certificates that they issue. Many teams are in charge of three to four public CAs that integrate across the entire company as well as an internal issuing CA. With all these CAs in play, you need an overview of activities at any time. 

Why to track it: Visibility into CA issuance is important to detecting any unusual, ominous or hidden activity. For instance, one organization thought they had 1,000-2,000 certificates, but a Keyfactor inventory scan found more like 200,000 certificates. We discovered a server in the environment was rebooting every six hours, and whenever it rebooted, it requested a certificate — and this had gone on for two years without anyone noticing. 

How to track it: A report can show you the number of certificates that each CA issues daily, providing visibility to pinpoint trends and get ahead of any issues. If your team expected to issue two or three certificates a day but then you see triple that activity, you can identify which CA is causing the spike and investigate further, since this could indicate malicious activity. Overall, seeing those spikes and anything else out of the ordinary is a great indicator that something might be wrong and warrants a closer look.

5) Demandeurs et propriétaires de certificats

What to track: Next you need to know who is requesting certificates and who owns those certificates. Although this sounds simple, handing out certificates can get unwieldy very quickly, becoming like that classic Oprah moment “you get a car and you get a car!” 

Why to track it: You need to know who requested a certificate and who owns it because when there’s a certificate expiration or operational downtime, you need to know who to go to for the renewal. Typically when outages happen it’s because someone wasn’t paying attention to a certificate or there was no renewal process in place. 

And it only takes one certificate to cause an outage, such as the Microsoft Teams outage that happened shortly after COVID hit. It was just one certificate that expired, but it was a huge hit to Microsoft at a time when Zoom was starting to become dominant.

How to track it: The best way to track certificate requests and ownership is to introduce a report that offers a detailed view of who requested a certificate, who owns it, where it is and who to notify about an upcoming expiration and renewal.

6) Certificats auto-signés

What to track: As DevOps teams grow, most organizations see a rapid increase in self-signed certificates put in place by the engineering team to keep up with the faster pace of development. A self-signed certificate is one that is not really public or private — it’s basically an onboard CA that’s attached to a certain tool, and it’s critical to understand where they exist.

Why to track it: Many organizations try to figure out how they can make self-signed certificates compliant with their PKI policy. Often they go about this by integrating their PKI program with HashiCorp Vault or a CA on their Istio service mesh. These integrations can get out of hand fast, but they do show exactly where the certificates are. Otherwise, security teams likely have limited to no visibility into where the engineering team issued self-signed certificates.

How to track it: This type of shadow IT primarily exists when certificates are cumbersome for developers to obtain. What you need is a report that shows who is going around your policies and when. Then you can use that insight to identify ways to improve your processes to make it easier for them to get certificates securely without slowing down their processes.

7) Certificats Wildcard

What to track: A wildcard certificate is a single certificate that’s used on multiple subdomains. They provide a lot of cost savings, but a single point of failure with the certificate can affect multiple areas of the business. This presents a huge risk in terms of outages and attacks.

Why to track it: If you don’t know which certificates are wildcards or if you don’t know every application using a certain wildcard certificate, you’re left with a blindspot. Specifically, if something goes wrong with that certificate or you need to renew it, you’ll have difficulty identifying everything that could be affected. This recently happened to Spotify, when the entire service went down because the team forgot to renew a TLS certificate that was a wildcard. 

How to track it: You need a report that tells you which certificates are wildcards and the subdomains to which each one is attached. The best way to do this is to mark any wildcard certificates in a certain way, for example with an asterisk. Without this type of report, you might not know that a certificate is a wildcard. Or even if you do, you might not know every application consuming the certificate, and the only way to identify that is through manual network scans.

8) Certificats automatisés ou manuels

What to track: Which certificates have automated deployments and renewals and which certificates require manual updates? Generally, the more automation the better. 

Why to track it: High automation allows for a more dynamic approach to your PKI operations and certificate management practices, whereas lower the automation leads to higher risk for outages. Further, automated certificates help with the default 90 day lifespan of certificates, as you don’t want someone to have to replace those certificates manually every 90 days.

How to track it: First you want a report that shows which certificates are automated and which are manual. Going one layer deeper, the nice thing about automation is that it will also create reports that show you how many certificates are getting renewed. This will display the lifecycle of certificates, so you can even get them replaced earlier than needed.

9) LCR Santé

What to track: Certificate revocation lists (CRL) tell you whether or not a certificate is still valid, and they sit at the crux of PKI management. For example, if someone leaves your company, you might revoke their certificates, and a CRL makes that known so that others don’t trust those certificates anymore.

Why to track it: The CRL lives in a public place where anyone can check it. If for some reason a person or service can’t reach it, then they should not trust a certificate. So if the CRL is expired or unavailable, every certificate issued from that CA will be considered untrustworthy. As a result, CRL health is a single point of failure and needs monitoring.

How to track it: Introduce a report that shows which certificates have been revoked and add the ability to see who’s revoking those certificates. It’s important to note that certificates can be revoked for all kinds of reasons: They might be compromised, they might not be needed anymore or they might have been superseded.

10) Certificats inconnus

What to track: The previous metrics are all things that you can easily find by scanning your network or scanning different endpoints. The last one involves finding all of the certificates in your environment that you don’t know about, that way you can bring them into your database to eliminate blindspots and allow for reporting.

Why to track it: Before you can scan certificates to get specific information on them, you first have to know every single certificate that’s out there. What’s worse than not managing a known certificate is not managing an unknown certificate, and that makes it essential to have a complete inventory of all the certificates that exist.

How to track it: Scan your environment for all the ports that you have open that could be hosting certificates. If you know where certificate stores are, even if you just know the server name, you should be able to configure automation or an orchestrator to crawl that server and look for certificate stores. Then you can bring everything you find into one single database that you can report on. As you do so, look for things like a misspelling in your company name on a certificate, as that could be an indication of malicious activity.

Tout mettre bout à bout

Bien qu'il ne s'agisse là que de dix des nombreuses mesures à suivre sur PKI , elles offrent ensemble une grande visibilité qui peut aider votre équipe à atteindre l'agilité cryptographique. Et maintenant ? Il est temps de tout regrouper pour faciliter la visualisation. Nous vous recommandons de commencer par les tableaux de bord suivants :

• Monthly Executive Report: Give executives a glance into issuance activity over the past month compared to the previous month. This provides a quick peek into the health of the CA, and it allows executives to quickly see if there are any red flags that need investigating (such as a large number of certificates set to expire in the next 2-4 weeks that could present a risk of outages). It also helps executives understand what to plan for when it comes to scaling the PKI architecture. For instance, do you need to stand up another issuing CA to take care of an increased load of certificates?
• PKI Status Report: Create a birds-eye view of PKI health metrics, like issuance, expirations, key strength and CA activity, for the more technically-minded executives. This gets into more detail while still providing an at-a-glance view of everything going on. It should also allow you to filter things like certificate collections by departments and to view or adjust expiration alerts. Overall, it provides a nice overview for a busy executive that understands the value certificates bring to the security of the organization and allows them to plan for improvements, like introducing more automation to reduce risk and free the security team’s time to focus less on renewals and more on value-add activities.

Vous souhaitez en savoir plus sur l'importance de ces indicateurs et sur la manière de commencer à les suivre ? Cliquez ici pour visionner notre webinaire sur les dix principaux indicateurs PKI pour plus de détails et de conseils.