PKI – Assessment

continue

"The concept of risk is built around the fact that a lot of things can leave you open to a problem and often you don’t even know what these things are."

Encryption Consulting has their own custom framework for doing a Public Key Infrastructure (PKI) Assessment for a customer based on NIST, PKI & HSM best practices. Every area of the customer’s PKI is evaluated and assigned a risk rating. This enables organizations to identify high risk components and prioritize remediation efforts. The scorecard from Encryption Consulting is an invaluable tool to security teams trying to plug gaps with a limited budget.

The PKI Assessment engagement will consist of assessing the current certificate management practices used by the Customer and the development of a strategy and roadmap for certificate management.

Below are the objectives of the PKI Assessment.

We at Encryption Consulting strive to follow every objective on every engagement:

Understand the current state of PKI systems, processes, and use cases across the organization
Assess the maturity of the PKI environment against a defined framework and comparative organizations
Provide observations and recommendations regarding current and future PKI initiatives to help achieve Customer’ desired future state capabilities

In this phase of the engagement, we will perform the following activities:

Review Customers existing PKI (on-prem /Cloud-based PKI) procedures across the customers’ environment. The review will include an assessment of current certificate request, issuance and provisioning processes, and review the current policies.
Analyze the current inventory of certificates provided by the Customer for the following certificate types: server TLS (Transport Layer Security), email S/MIME (Secure/Multipurpose Internet Mail Extensions), code signing, client and device certificates.
Assist the Customer in defining a future state for certificate management with the following goals:
- Enhanced security & governance
- Consolidation and simplification of tools, processes etc. globally.
- Automation (e.g., ServiceNow integration, end to end life cycle etc.)
- Cost optimization
Assist the Customer in developing a strategy for PKI based on the observations from the review program analysis, the Customer’s certificate inventory analysis, and the defined future state.

This engagement will be delivered over an eight-week period.

PKI Assessment

EC will perform the following activities and document the results for deliverables:

Identification of stakeholders and information gathering sessions
Review of current process followed across the business units globally
Analysis of Customer provided certificate inventory
Identification of gaps and provide recommendations as required

PKI Strategy and Recommendations

PowerPoint presentation with strategy and recommendations, including:

Summary of observations from the certificate management assessment
Definition of future state including, but not limited to, requirements for certificate management
Recommendations for process and technology for certificate management
A strategy and high-level transition plan from current to future state