Cyber Defense eMagazine December Edition for 2021

Building digital trust
With identity becoming the new network perimeter, verifying digital identities on a network is integral to a
zero-trust strategy. But limiting verification to user identities is not sufficient. Proper zero trust
implementation is heavily dependent upon digital certificates and key pairs. The objective is to strengthen
security and ensure device verification along with identity verification.
Adopting the zero trust model starts with segmentation, implementing privilege access management
(PAM), multi-factor authentication (MFA), vulnerability and patch management, and security analytics.
However, companies miss out on one crucial area, and that includes managing machine identities. This
opens risks rising from compromised encryption tunnels.
Manually managing certificate lifecycles whether it’s through spreadsheets – or paper documents – is
time-consuming, error-prone, and highly inefficient. With hundreds of thousands of certificates in
circulation, administrators cannot rely on manual management techniques to ensure that public key
infrastructure (PKI) is constantly secure and up to date. There is a pressing need for a management
system that includes alerting processes and automated workflows for PKI tasks such as certificate
renewal, requisition, revocation, deployment, and more.
Recognizing the power of automation
While digital certificates contribute much to a zero-trust architecture, organizations need a managed
solution with the capabilities to automate the certificate lifecycle. Implementing an end-to-end certificate
lifecycle automation solution is a key initiative towards achieving a fully functional zero trust model.
Automation tools simplify certificate operations by allowing administrators to carry out all necessary
activities from a single interface (i.e., without using each certificate authority’s interface to renew or revoke
the certificates they have issued). Last, automation helps enable cryptographic agility. For example,
digital identities can stay on top of protocol and algorithm upgrades to offer the best possible protection
under all circumstances.
Embracing PKI to secure networks
It’s no longer enough to simply set up the necessary SSL certificates on websites and servers and renew
them once every few years. PKI protects nearly every internet-facing system (and its back-end servers),
software programs (in the form of code-signing certificates), and communication in general. There have
been well-documented occurrences of PKI being the weak link that resulted in data breach, such as the
Cyber Defense eMagazine – December 2021 Edition 140
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.