Your PKI design and certificate policy have an impact on the security of your network and devices as a whole. You should design and implement your PKI to fend off typical dangers, much as you would guarantee your home has an earthquake-resistant foundation or a hurricane-resistant roof.

Many of these choices must be made in advance, during the design and development of your software or product. Although it takes work to implement the required security measures in your PKI, taking the necessary precautions will help you reduce security concerns in the future.

Think about this, What risk to your security would a compromised certificate on your network? Could a server be accessed using the certificate’s authentication? Could it be used against your users in a man-in-the-middle attack?

When creating a programme or device that makes use of certificates for authentication or secure communications, these queries should be carefully considered. Technical choices must be made regarding how your product will handle certificates and how your PKI will be designed and managed.

This article is intended for designers and producers who work with private-trust client or device certificates, such as those found in software or Internet of Things (IoT) devices.

Creating a PKI with Long-Lasting Security

We frequently converse with developers who are unaware of their alternatives for creating PKI and certificate policies. You have a lot of flexibility with private-trust PKI when it comes to your client and device certificates, enabling you to increase the security of your program or device.

We’ll go into detail about three crucial factors you should take into account to improve your PKI. Choosing certificate validity periods and replacement, safeguarding private keys, and utilizing certificate revocation—as well as how to use these controls effectively to reduce risk—are the first three topics.

Although certificates offer authentication and encryption, using them is not as straightforward as just installing them and calling it a day. Both of these qualities can be jeopardized, but with right mitigations they can also be strengthened.

The simplest solution could be to set up a shoddy PKI and never worry about managing your certificates, but this comes with security risks you might not have thought about.

Let’s use the recent deprecation of SHA-1 as an illustration. Researchers were aware of the weakness of the SHA-1 hashing method, which was designed to give cryptographic signatures to uniquely identify certificates. Last year, Google showed two distinct files with the same hash in a real-world collision.

The SHA-1 algorithm was effectively killed out by this collision, and many certificates were changed with the more secure SHA-2 algorithm to maintain security. Long-lived certificates were also included, which would become more exposed as time went on (computing power increases make it easier to exploit). Even if a SHA-1 collision would seem impossible right now, what about in 5 years? 20 years? These are crucial factors to take into account if your products will be used over an extended period of time.

The complexity of PKI security is quickly demonstrated by this straightforward example. You would need a technique to reissue and replace certificates on your devices, a revocation mechanism to deal with certificates you know were compromised, and the assurance that your network and users are no longer exposed to reduce the security hazards of a flawed hashing algorithm.

Validity of a Certificate

In the SSL/TLS realm, compromised technologies are an unavoidable issue. The protocol’s fundamental cryptographic technologies are built with a deprecation date in mind since we anticipate that stronger computers in the future may eventually compromise their security.

Major changes have occurred over the past ten years, such as the abandonment of the MD5 and SHA-1 hashing algorithms and the switch to 2048 bit. We’ll eventually run out of 2048-bit keys and have to replace them. It will be much easier to deal with these changes if you have a plan in place.

You must weigh the benefits of a long-lasting certificate against the difficulty of safeguarding long-lasting keys when determining the validity time for your certifications. Protecting these keys becomes more difficult over time as encryption standards deteriorate, are replaced, and as your collection of certificates expands. A flawed algorithm may eventually necessitate the urgent replacement of certificates for sustained security, as in the case of our SHA-1 example.

It’s important to think about both the expiration date and the process for replacing your certifications. Most of the time, we’ve discovered that trying to use a single certificate throughout the device’s lifetime involves too many security trade-offs.

You establish a wider variety of certificates (and accompanying private keys) that need to be kept secure by selecting longer validity periods. Because it grants them access for extended periods of time, this expands the number of targets for attackers and motivates them to compromise a certificate. This in turn makes having a revocation system more crucial and necessitates keeping revocation data on hand for longer periods of time, resulting in bigger revocation files and greater network activity.

However, creating a secure PKI does not require that certificates be changed every year. Long-lived certs can still be used while making effective plans for these changes. When you replace and renew device certificates, you can select the validity term that works best for you without being concerned that you’ll need to replace them in the future.

Keeping Private Keys Safe

Key compromise shares many of the same security factors as certificate validity. Attackers can mimic a device, decrypt and read data, and authenticate to a network if they can obtain a private key.

Keys must be safeguarded against compromise, revoked, and replaced if they are ever compromised if you wish to offer real authentication and encryption. This means that putting keys on a device in plain text, where they could be easily extracted, is not a good idea. Instead, think about a hardware defense like a secure chip (TPM) or a software solution like an encrypted key store, which offers real defense against attackers.

Even if you think your keys are suitably safeguarded, it’s crucial to have a functional revocation scheme. Attackers may become interested in finding a means to circumvent your security measures if they discover there is no practical way to stop them when they steal a key. An additional line of defence called revocation serves to neutralise and dissuade intruders.

These barriers have a lot in common. A dependable revocation system—one that can handle a high rate of revocations—becomes more crucial and expensive if your keys are simple to compromise.

Revocation

Because certificate revocation is a “high-cost” service that necessitates an active internet connection and high availability, several manufacturers and developers think they can’t support it. That is not the situation. You can check revocation information using industry-standard technology without connecting to a server or using the internet at all.

CRL (Certificate Revocation Lists) and OCSP are two technologies that are widely used in the business for verifying revocation information (Online Certificate Status Protocol). A CRL is comparable to a blacklist of serial numbers for certificates for individuals who are unfamiliar with these systems. With OCSP, the client sends a request across the internet to a central service to learn the status of a certain certificate’s revocation—much like calling an API. The X.509 certificate protocol includes both the CRL and OCSP protocols.

The more straightforward option, CRL, gives you flexibility in situations where your device might not have a dependable or quick internet connection. Traditionally, the issuing CA signs a CRL file every day, which the client can access online. However, the CRL can be cached and stored in circumstances where the device cannot quickly or routinely connect to the internet.

CRLs are signed and have a validity period, just like certificates. CRLs are reliable because they are signed by the CA. A CRL does not have to be sent from the CA directly to the device. Instead, they can be dispersed via a network, such as an internal network or a centralised cloud server. This has a benefit over a straightforward blacklist or whitelist. If a CRL file has a valid signature, you can download it from any location without worrying about manipulation.

When a CRL expires, which can be set for weeks or more, it can be cached on a device and used until then. Because of this, it’s a suitable choice for devices with spotty or erratic internet connections. This enables you to keep the advantages of revocation checking in many situations without incurring the technical expenses of repeatedly getting new data.

As long as the devices have access to a gateway or server that does, OCSP can also be used when the devices themselves do not have internet connectivity. The revocation information can be transmitted during the TLS handshake thanks to an optional OCSP feature called “stapling,” which enhances network performance. Both OCSP and CRLs can be implemented, with the most current CRL serving as a backup.

The fact that a commercial CA will already support one of these standard approaches is a benefit of employing it. They are flexible standards that may be customised to meet your unique needs because they support a wide range of possibilities.

Conclusion

All of these precautions are used to reduce and manage risk. Attackers are less likely to target well-protected keys neither the ones that can be easily revocked and replaced.

Your decisions on certificate policy and PKI design are connected. Imagine a situation where the revocation system is very quick, but the private keys are stored in plain text on the device. It would be simple to compromise these keys, and you would need to revoke your certifications as soon as you issued new ones. On the other hand, if your private keys are well protected but there is no effective way to indicate that a key has been hacked, your system will likewise be vulnerable.

A solid security foundation for your devices and network is created by creating a robust PKI that takes the technical requirements of your product into account. Simply selecting the laxest policies now might result in challenging engineering difficulties later.

If you need help with your PKI environment, feel free to email us at info@encryptionconsulting.com.

Free Downloads

Datasheet of Encryption Consulting Services

Encryption Consulting is a customer focused cybersecurity firm that provides a multitude of services in all aspects of encryption for our clients.

Download
Encryption Services

About the Author

Kirtan Dua is a Cyber Security Consultant, working on PKI, security in the cloud, and key management.

Reading time: 10 minutes, 53 seconds

Trust is crucial in the software-driven society we live in. But how can we tell which software to rely on and which to avoid? We can thank code signing for that.

Developers use code signing to demonstrate a piece of software’s legitimacy and ensure that it originates from a reliable source and hasn’t been tampered with. Cryptography, more especially a certificate known as a code signing certificate, is necessary for code signing.

Customers should constantly be on the lookout for third parties posing as software providers while downloading software from the Internet. Software may be ensured that it is coming from the right source with the use of a tool like code signing. To ensure that consumers are receiving software that accomplishes what its creator claims it will, code signing is a process where a software developer or distributor digitally signs the file being sent out. The signature indicates that the code has not been altered from its original state.

Benefits of Code Signing

Code signing is a technique for adding a digital signature to a program, file, software update, or executable so that, upon installation and execution, its validity and integrity can be checked. It ensures to the receiver who the author is and that it hasn’t been opened and tampered with, much like a wax seal. To demonstrate, for instance, that your Windows 10 update genuinely came from Microsoft and not a hacker attempting to breach your machine, Microsoft developers, programmers, and software engineers utilize code signing.

You can be confident that you are downloading a file from a legitimate author or publisher and not from an attacker trying to steal your personal information and data thanks to code signing. In essence, it informs you that a bad guy hasn’t changed the code so you know it’s safe to install and run on your machine.

If you’ve ever seen the small window that appears when you attempt to launch a software you’ve downloaded, the one that asks, “Are you sure you want to run this? ” and identifies the publisher, then you know what I’m talking about. then you have experienced code signing. That dialogue box informs you that the patch for your Mac OS X is authentic and still in the same state as when it was signed by Apple Inc.

What Does Code Signing Do?

As a user, code signing serves a few distinct purposes that might assist you in determining if you should trust software downloads and other online interactions. Code signing is mostly used to verify the authorship of files, downloads, and software. For instance, you are more likely to install a download file supplied to you from Microsoft than one from any other source since it will seem to be much more reliable.

There will inevitably be updates for the software you install on your computer in the future. You may be sure that subsequent updates have come from the same source and are secure to run on your computer when they are code signed with the same key that was used to “seal” your initial downloads.

How Does Code Signing Work?

From the perspective of a developer, code signing has three main parts: unsigned software files; code-signing certificates; and code-signing apps. Applications for code signing are typically included with operating systems like Microsoft Windows, Mac OS X, etc. Certificate Authorities are frequently the source of the code signing certificates (CAs).

Public Key Encryption

When you encode a message to shield it from unauthorized viewers, you are using encryption. Decoding the message depends on knowing the key that puts the values back to their original state, enabling the message to be read. Typically, this is done by running it through a mathematical function (referred to as a “key”) to alter values. The key that encrypts the message and the key that decrypts it is distinct in public key encryption (also known as asymmetric encryption) (hence asymmetrical). It is known as a “public key” system because only one key—the “public key”—is used to secure the communication, while the other—the “private key”—is kept secret.

Private keys must be kept secure, confidential, and out of the hands of anybody who would try to intercept or tamper with messages in order for this type of encryption to work. The kind of transmission determines whether the public key is used to encode or decode the message. Encrypt using the private key and decode with the public key if you want everyone to be able to read the message but don’t want anyone to tamper with it. You encrypt using the public key but decode with the private key if you want everyone to be able to send messages but don’t want them intercepted by the incorrect person.

Hash Function

A form of encryption called hash functions is intended to be irreversible. Hash functions are designed to be one-way, utilizing a mathematical function that modifies the data in a way that can’t be undone, as opposed to encoding with a key and using a key to decode. The most typical comparison is like mixing paint. As an illustration, mixing blue (the original values) and yellow (the hash function) will always result in green, but there is no way to separate the two colors and get back the blue.

When you require a set value and don’t need to read the data again, hash functions are utilized. The most prevalent example is login passwords, which are frequently hashed by websites for storage. If there is ever a breach, all the hacker has obtained is a collection of random numbers. The website hashes your password once again and compares it to the previously saved hash value when you log in. They let you in if the information you provided matches what is in their records. They only need to know the value; they don’t need to read the password itself.

Code Signing Certificates

Before the developers can sign their work, they need to generate a public/private key pair. This is often done locally through software tools such as ‘OpenSSL’. Developers then give the public key and the organization’s identity information to a trustworthy CA. The CA verifies the authenticity of identity information and then issues the certificate to the developer. This is the code signing certificate which was signed by CA’s private key and contains the developer organization’s identity and the developer’s public key.

Developers take all the code they produced and hash it when they’re ready to “sign” it to prove authorship. The output value is then encoded using the previously stated private key, which is often created by the author, as well as the code signing certificate, which contains the public key and the author’s identity (proving the authorship). The result of this procedure is then included in the program that will be distributed.

This is an instance of code signing. The majority of browsers and operating systems come with the public key of the CA pre-installed. When a user downloads the program, they first authenticate the legitimacy of the code signing certificate incorporated in the signed software to ensure it’s from a reliable CA using the CA’s public key. The encrypted hash is then decrypted using the developer’s public key, which is subsequently taken out of the certificate.

The program is then hashed once more, and the result is contrasted with the decrypted value. The program has not been tampered with or damaged during transmission if the hash values generated by the user and the developer coincide. The user is then informed that the program is in the same condition as when the developer last left it and that it is safe to install and execute if the developer can be believed.

Root Certificates

Code signing can provide you, the end user, confidence in the reliability and validity of the downloaded program. However, you should also be mindful that malicious actors may produce a code signing certificate and a public-private key pair to give the impression that they were authorized by a legitimate CA. How do you determine whether certificates are reliable if anybody can create a code signing certificate?

Root certificates have a role in this. Code signing certificates can be compared to a family tree. You may trace certificates back to discover which signing certificate—your root certificate—is at the root of the tree in order to confirm where they originated. Because you can follow the “chain of trust” back to the initial signing authority with the root certificate, you can tell whether the other code signing certificates are reliable.

A business like Apple or Microsoft might be considered the root authority. The system will warn you not to trust the certificate that was used to sign the program you are attempting to download if your software’s signing certificate is unable to locate a reliable root certificate. Even a trusted authority may occasionally fail to be recognized if it is not installed on a browser or in the trust store of an operating system. For the browser or operating system to accept the root certificate as reliable and valid in these situations, you will need to manually put it on your trust store.

What Are the Types of Digital Certificates?

Different systems require different types of authentication. What works on a desktop is likely unsuitable for mobile systems and vice versa. Here are a few examples of the different certificates for both desktop and mobile software.

Desktop Certificates:

  • Microsoft
  • Java
  • Microsoft Office and VBA
  • Adobe AI

Mobile Certificates:

  • Windows Phone
  • Windows Phone Private Enterprise
  • Java Verified
  • Android

If you’re looking to sign and secure your software, you should first know what kind of software or system you are starting with and work from there.

What is the Use of a Digital Certificate?

A digital certificate is meant to provide the software or code you’re distributing to your users with an identity. Users can verify the program publisher using a digital certificate. Because these digital certificates are issued by certificate authorities, users have more faith in the publishers. The ability to track their product and the number of downloads gives digital certificates to software providers a lot of additional value.

How Long is a Digital Certificate Valid?

How long a certificate is valid is another typical query from those trying to obtain their own digital code signing certificate. Digital certificates normally only have a year or two of validity, however, the actual duration might vary depending on the issuer.

This validity is brief for the following two reasons:

Private keys and security certificates may and do become hacked. Any prior certifications, even those that have been stolen, become invalid upon renewal and change every year or two.

Technology is evolving at an even quicker rate than the rest of the globe. Five years ago, what was secure is no longer nearly as secure. Code signing certificates can be updated and changed to keep the certificate security current.

Where is Code Signing Used?

Code signing is used any place a developer wants a user to be sure of the source of a piece of software. This includes:

1. Windows applications and software patches

2. Apple software

3. Microsoft Office VBA objects and macros

4. .jar files

5. .air or .airi files

6. Essentially any executable

Be aware that, because of the distributed nature of Linux development, code signing is often not used for Linux-based software, so that software may come unsigned. If that happens, your computer will (if it gives any notice) will tell you it’s from an “unknown developer,” or something along those lines. Here are a few other applications and software that utilize code signing to increase their security.

  • iOS: Code signing in iOS for the App Store is done using Xcode. The purpose of signing your app is simply to let iOS know who signed the app originally and to make sure it hasn’t been altered since it was originally signed by the developer. If you need to revoke your iOS certificate, you will need to use your developer account or Xcode to complete the process.
  • Xcode: Xcode is used by iOS to code sign apps and ensure their security. Before any device can be uploaded and approved for the iTunes store it must have a valid Apple Developer ID with a valid certificate or profile. To successfully integrate your app, you will need to use a development certificate. In order to run the app on any device, you must use a distribution certificate to send out the app and test it.
  • C#: Visual C# uses strong name signing to get a unique sign code that is not available to anyone else in the world and cannot be spoofed. When using Visual C#, you can simply sign your deployment using the sn.exe tool. This functions as your signature by using sig check tool printing “Strong Name: Signed.”
  • Windows Certificate: Nearly any executable can be signed with a digital signature to verify the security and integrity of the file. For the file to be considered secure in Windows, it must be signed by a recognized certificate authority. Anyone who distributes malware under a valid certificate is held legally accountable for the software they distribute.
  • Visual Studio: Visual Studio is particularly helpful when it comes to strong name signing for assemblies—a notoriously difficult task. Strong name signing through Visual Studio allows other computers to trust the software developer.

Free Downloads

Datasheet of Encryption Consulting Services

Encryption Consulting is a customer focused cybersecurity firm that provides a multitude of services in all aspects of encryption for our clients.

Download
Encryption Services

About the Author

Kirtan Dua is a Cyber Security Consultant, working on PKI, security in the cloud, and key management.

Read time: 6 minutes, 25 sec

What is Data Loss Prevention?

Data Loss Prevention (DLP) is a solution for exposing sensitive data.  DLP is used by organisations to safeguard and protect data as well as to adhere to legislation. Through their network, businesses transmit sensitive data to partners, clients, remote workers, and other authorised users, but occasionally an unauthorised user may be able to intercept it.

Organizations need to protect sensitive data due to multiple industry and government regulations such as HIPAA and PCI-DSS.

Why your organization needs data loss prevention?

A “borderless” network perimeter with numerous attack vectors has been produced by today’s digital transformation, which started with mobile devices and continued with embedded systems, social media applications, hypervisors, and the proliferation of connected devices.

Organizations need to make sure that their most sensitive data and assets are secured in order to adapt to this technological transformation. When implemented correctly, DLP offers visibility, granular control, and data security coverage to defend against human error-related data loss and external threats. The creation of a thorough data loss prevention strategy shouldn’t be put off; it may assist your business in safeguarding its “crown jewels,” ensuring compliance with the changing regulatory environment, and preventing the publication of the next data breach story.

You don’t know where the private information of your business is kept, where it is sent, or who is accessing it.

DLP technology gives IT and security employees a complete picture of where data is located, how it moves through the organisation, and how it is being used. It lets you to protect and maintain control over sensitive data, such as customer information, personally identifiable information (PII), financial information, and intellectual property. It does this by comparing network actions to your organization’s security regulations. Your firm will be able to develop the right rules to safeguard this data and decide which assets need to be protected and at what cost after having a complete grasp of this data.

Although your business has a plan in place to guard against external intrusion, it does not cover employee theft or the unintentional disclosure of sensitive data by partners and employees.

Data loss may not always occur as a result of outside, hostile attacks. One important factor is internal employees accidentally disclosing or improperly handling confidential information. In 28 percent of the attacks, insiders were involved, according to Verizon’s 2018 Data Breach Investigations Report. It can be particularly challenging to protect against insider threats because it’s difficult to tell when someone is abusing their rightful access to data. DLP has the ability to identify confidential information-containing files and stop them from leaving the network. It has the ability to implement policies that protect data on an as-needed basis and can stop sensitive data transfers to USB devices and other removable media.

For instance, access to a particular endpoint may be immediately barred in the event that a security event is discovered. In response to occurrences, policies may also quarantine or encrypt data

The responsibility, adverse exposure, penalties, and lost revenue linked to data breaches worry you.

Alarmingly frequently, data breaches have been in the news. Through fines, negative publicity, the loss of important clients, and legal action, they can wreak financial havoc on an organisation. The mean time to identify (MTTI) breaches have reportedly reached an average of 191 days, which equates to nearly six months of dwell time for attackers, according to the Ponemon Institute’s 2017 Cost of Data Breach Study. Lateral movement is made possible by dwell time, which is essential for boosting hackers’ chances of success.

You’re worried about your next audit and wish to continue adhering to the intricate laws.

Regulations like the GDPR and New York Cybersecurity Every regulated firm that collects, stores, and utilises sensitive customer data must raise the bar to meet new standards as a result of requirements, which are ushering in a new era of accountability. Failure to comply with regulations may result in fines of up to 4% of annual global turnover and orders to stop processing. Controls over technology are becoming important in some instances to achieve compliance. These controls are offered by DLP, together with policy templates and maps that cover certain requirements, streamline compliance, and permit the gathering and reporting of metrics.

Data must be safeguarded from security risks brought on by BYOD and IoT.

DLP assists in preventing the unintentional disclosure of sensitive data across all devices when used in conjunction with complementing safeguards. DLP can monitor data and dramatically lower the risk of data loss wherever it resides, whether it is in use, at rest in storage, or in transit over the network.

Types of DLP Solutions

An company might lose data in a number of ways. The numerous methods that sensitive data may be removed from an organisation should be able to be recognised by the DLP solution. The various DLP solution types include:

Endpoint DLP

Data on the network’s devices is monitored by an endpoint DLP solution. To monitor and safeguard the data stored on endpoints such as laptops, servers, smartphones, printers, etc., this solution is installed. Even when the endpoint is online or linked to a public network, endpoint DLP safeguards the data on such endpoints. Additionally, this method stops sensitive data from being transferred to USBs

Network DLP

This DLP system is put into place on the network and keeps track of data transfer. Any device linked to the network may monitor, safeguard, and prevent all incoming and outgoing data. All of the network-connected devices can be subject to the DLP policies. Data on offline devices cannot be protected by this solution; it can only secure data on devices that are connected to the network.

Email DLP

The email DLP system keeps track of emails and filters them based on particular keywords. This remedy can lessen email-based data leaks.

Cloud DLP

A cloud DLP solution keeps an eye on and safeguards the data kept in the cloud. Emails, documents, and other forms of files may all be protected and monitored with the service.

Techniques needed for your data loss prevention

  • Determine the primary data protection objective in order to determine the appropriate DLP solution for the organization.
  • Implement a centralised DLP programme and collaborate with various departments and business units to define standard DLP rules that control data for the organisation. Data visibility will rise as a result throughout the organisation.
  • Make an evaluation of the different forms of data and their importance to the company. Determine the type of data, whether it is sensitive, and where it is stored. Consider the data exit points. Then assess the danger of each type of data being compromised to the organisation.
  • Make a method for classifying data that includes both structured and unstructured information. Internal, private, public, personally identifiable information (PII), intellectual property, and other types of data may exist.
  • Create policies for data processing and correction for various sorts of data. DLP software comes with pre-configured rules based on laws like GDPR and HIPAA. These guidelines can be altered to suit the requirements of the company. Create controls to lower the danger to the data. To lessen the unique data risks, organisations should build granular, fine-tuned controls.
  • Employee education can lower the possibility of insiders accidentally leaking data. A good data loss prevention programme depends heavily on employee knowledge and comprehension of security standards. Employee understanding and adherence to data security policies and best practises can be improved with the support of awareness campaigns and trainings such as posters, emails, online trainings, and seminars.
  • Utilize indicators like the number of events, the mean time to incident response, and the proportion of false positives to gauge how effective your DLP system is.

Conclusion

A company’s security depends heavily on having the right cyber security platforms and solutions in place. Any firm can utilise DLP to stay ahead of threat actors, whether they are internal or external. Any business, especially banks and healthcare companies, must prioritise protecting sensitive consumer and corporate data. At Encryption Consulting, we place the utmost importance on cyber security. We work with organizations to create the most secure environment possible using methods such as DLP, Public Key Infrastructure (PKI), and encryption assessments. We provide assessment, implementation, and development services for PKI, encryption, and Hardware Security Modules (HSMs). If you have any questions, visit our website at www.encryptionconsulting.com.

Free Downloads

Datasheet of Encryption Consulting Services

Encryption Consulting is a customer focused cybersecurity firm that provides a multitude of services in all aspects of encryption for our clients.

Download
Encryption Services

About the Author

Kirtan Dua is a Cyber Security Consultant, working on PKI, security in the cloud, and key management.

Let's talk