Tag: HSM

In the previous article, we explored the importance of Public Key Infrastructure (PKI) from an enterprise architecture perspective. We also saw some of the typical enterprise application scenarios that need to use PKI, including public facing web sites and web applications, Virtual Private Network (VPN) services, mobile applications and software (code signing). This article illustrates a few of the other enterprise application scenarios where PKI needs to be an integral part of enterprise architecture.

1. Enterprise cloud applications: Cloud computing is truly mainstream today: a recent Rightscale research report from Flexera indicates that 94% of organizations leverage some type of cloud technology. The benefits of cloud including elasticity, location independent access, and usage-based pricing for infrastructure have overcome the earlier apprehensions of moving applications and data to the cloud. However, enterprises need to be as vigilant as ever to ensure appropriate identity and access management (IAM) solutions are in place for their cloud applications. PKI is one of the best IAM options for enterprise cloud applications and is much more secure than alternatives based on a username and password approach.
2. User authentication: Even within the enterprise, the use of PKI is going up rapidly. Verifying the identity of enterprise users and other entities such as devices using digital certificates makes a lot of sense today – especially considering the risk of insider threats and the need to have strict access controls as well as audit mechanisms in place. For example, code signing, as explained in the previous article, requires DevOps teams and developers to sign code as a part of the deployment and release cycles. PKI based user authentication can also help to restrict and monitor access to sensitive enterprise applications and data, such as personally identifiable information (PII) of customers, company IP and trade secrets, and company financials. In fact, the risk of data breach incidents where customer data is leaked or sold to the outside world by insiders, can be significantly reduced by leveraging PKI based credential management within the enterprise.
3. Email: For most enterprises today, email continues to be the primary communication mechanism between employees, and with customers and partners. With PKI, digital certificates can be used to sign and encrypt email. More specifically, you use your private key to sign an email you are sending, and you use the recipient’s public key to encrypt that email. The technology used is called Secure/Multipurpose Internet Mail Extensions (S/MIME), which is based on PKI principles. Most email providers and clients support S/MIME. Securing email communication is extremely important to address threats related to phishing. The recipient might get an email from somebody impersonating a known person (e.g. a colleague, customer or partner), requesting some confidential information or asking to click a link in the email. With PKI, the email client will alert the recipient that the sender’s identity could not be verified. Enterprises cannot afford to underestimate the importance of email security: cyber security research indicates that most cyber incidents and breaches start with a simple phishing email. Apart from the advantages of identity verification and protecting the privacy of the communication through encryption, non-repudiation is an additional advantage: with PKI in place, the email sender cannot deny later that an earlier email was sent by her/him.
4. Document management: Enterprises deal with a variety of documents that need to be formally signed by an authorized person – orders, contracts, petitions, agreements, forms, authorizations, and so on. Digital signatures provide a convenient way to sign these documents, since the enterprise is likely to be leveraging PKI in some form or the other anyway. The technology behind PKI ensures that the level of security available for digitally signed documents is much more than manually signed ones. Document management applications therefore need to be able to leverage PKI and digital signatures to ensure that documents are signed (and timestamped) as soon as they are generated, to ensure that any unauthorized changes can be immediately and automatically detected by security tools and platforms.

Summary
In today’s world, enterprise application architecture needs to follow a “Security First” approach. For example, with cloud technology becoming mainstream, cloud security also needs to become a top priority for enterprises. Similarly, for application authentication, enterprises can no longer rely on just a username and password approach, since enterprise applications are accessed anytime and from anywhere. Threats like phishing have resulted in email security becoming a hygiene factor and not just a “good to have”. Digital signatures for documents have become the norm, replacing manual signatures. Overall, enterprise architecture today requires application security to keep three needs in mind: stronger authentication mechanisms, validation of the device or endpoint that is being used to access the application and securing the communication channel between the application and the endpoint. PKI through digital certificates, provides a way for enterprises to address all three of these needs. This also means that enterprises need to think about good certificate management practices, including the set up of a private certificate authority (CA) where needed. That, however, is a different subject and will be covered in a future article. Stay tuned!

In an earlier article, we defined Public key infrastructure (PKI) as a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. We also identified some of the trends in digitalization which have been driving the adoption of PKI. As the adoption of PKI increases, enterprises need to understand which of their applications need to be “PKI enabled”. In other words, enterprise architectural blueprints should clearly identify the application scenarios to use PKI, and also flag non-conforming scenarios as potential security risks. In this article, we look at some of the typical application scenarios leveraging PKI in order to protect the enterprise and lower its risk profile.

1. Public facing websites and web applications: The padlock symbol in the URL bar of any web browser is now a de-facto requirement for any public facing website and application. The padlock represents an SSL/TLS (Secure Sockets Layer / Transport Layer Security) encrypted connection between the browser and the website that is set up using a digital certificate being sent from the website or web application server to the browser. The certificate confirms the identity of the website or web application to the browser. How does the browser know whether the certificate itself is valid and genuine? It verifies that the certificate has not yet expired and has been issued and ‘signed’ by a trusted third party, called a Certificate Authority (CA). Once the certificate is verified, the browser sends its public key across to the server, which uses this to encrypt the data that is sent back to the browser. The browser decrypts this data using its private key. All this magic happens seamlessly in the background, courtesy of PKI.
2. Virtual Private Network (VPN) services: The need to access an enterprise network remotely (for example from a different office location or a partner location) has existed for quite some time. The typical solution for this need is a leased line – a dedicated physical line between the remote location and the enterprise network. However, the leased line approach is not feasible for individual remote workers who need to access the enterprise network, such as employees who need to work from home. This is where VPN services, with the ability to provide a secure, encrypted communication channel for access to the enterprise network over the internet, have become extremely popular.
   When a remote user accesses the enterprise network through a VPN, a single authentication mechanism for example with a username and password is not secure enough. Multi-factor authentication (MFA) is important – with one of the authentication mechanisms being a digital certificate. The VPN channel (or ‘tunnel’) is set up only once the certificate validation is completed, as described earlier in this article.
3. Mobile applications: With every member of the workforce carrying at least one mobile device (and often more than one) and distributed teams (“work from anywhere”) becoming increasingly common, Enterprise mobility is on the rise. Mobile Device Management (MDM) platforms address some of the requirements of enterprise mobility by providing the ability to provision devices, manage mobile applications, and enforce the enterprise security policy on the device. However, authentication of mobile devices and users remains a challenge. An approach solely based on username and password is just not secure enough and the best way to ensure user identity. Mobile device validation and encrypted communication between the device and the enterprise network, using digital certificates is a far superior approach. Both the main mobile operating systems today i.e. iOS and Android, offer native support for digital certificates.
4. Software applications:Code signing: Companies who need to distribute software and the associated upgrades and patches to their customers, partners or employees usually do so today over the internet¹ . This however has brought new challenges to the forefront. Earlier, software that was distributed on physical media such as compact discs (CDs) was shrink-wrapped i.e. packaged in a box and physically sealed. Any tampering with the packaging and seal helped to alert the user. However, when the software is distributed over the internet, how does a user know whether the software (s)he is downloading is from the actual author? How does the user know that the software has not been tampered with and some malicious code or malware inserted into it? Code signing provides the answer to these questions. Any company that wishes to distribute software over the internet uses a code signing certificate to digitally sign the software. At the client side, the browser being used for the software download and the operating system (OS) on which the software is being installed, validate the code signing certificate and verify its authenticity. If the software has been tampered with, the user is alerted immediately. Without code signing, depending on the browser security settings, the user might get an alert, or the software may not get downloaded at all. If the user ignores the warning, downloads the software and attempts to install it, (s)he gets another warning, this time from the OS, that the publisher of the software could not be verified. As a result of these warnings, users may choose to abort the download, or abort the installation of the software – which is why it is important for companies to ensure that they sign the software that they publish. These are some of the enterprise application scenarios that need to use PKI. There are a few others – these will be covered in part 2. Stay tuned!

¹ Over the years, the sales and distribution of software CDs (compact discs) has declined significantly, with the internet becoming the primary means for software to be distributed to end users