WIXLIB

EBOOKWhy It’s Time to Re-thinkYour PKI5 reasons to move your PKI deployment to the cloud

Rethink your PKI eBookTable of ContentsINTRODUCTION. 3THE CHANGING ROLE OF PKI IN YOUR ENTERPRISE. 4GETTING IT RIGHT: THE COMPLEXITY OF PKI. 5BUSINESS CHALLENGES.7IN-HOUSE VS PKI AS-A-SERVICE. 85 REASONS TO MOVE YOUR PKI TO THE CLOUD. 9KEYFACTOR PKI AS-A-SERVICE. 11 2021 Keyfactor, Inc. All Rights Reserved www.keyfactor.com2

Rethink your PKI eBookIntroductionWhether it is securing a network, sensitive data, or connected devices, IT leaders turn toPKI as the proven technology to establish trust in their environment. With vast coveragethat spans across the enterprise, PKI is a complex undertaking, requiring highly securefacilities, trained personnel, and the right hardware and software to run it effectivelyand keep it under control.To achieve this goal with limited IT and security resources, more and more organizationsare moving their PKI to the cloud. Agility and security of cloud infrastructure has enabledhighly secure cloud-based PKI deployments — known as PKI as-a-service (PKIaaS) —hosted and managed by a trusted partner.Moving PKI to the CloudNot long ago, IT leaders were reluctant to put any dataor applications in the cloud. Now most have realizedthat cloud service providers like AWS, Microsoft Azure,and Google Cloud invest far more in the people andprocesses required to deliver reliable and secureinfrastructure.State-of-the-art data centers are built to the highestof organizationshave or plan tomigrate theirPKI deploymentto the cloud.1standards in security, with everything from physicalaccess controls to multi-layered encryption. Moving tothe public cloud has allowed teams to focus more attention on protecting sensitive data and mission-criticalworkloads, and to worry less about keeping the underlying infrastructure running and secure.Organizations have similarly recognized that movingtheir PKI to the cloud — managed by industry expertswith the right knowledge of standards and bestpractices — can help them achieve much higher levelsof security and operational efficiency than is feasiblein-house. As businesses become more reliant thanever on PKI for encryption, authentication and digitalsignatures, the importance of getting it right cannotbe overstated.12020 Keyfactor-Ponemon Report 2021 Keyfactor, Inc. All Rights Reserved www.keyfactor.com3

Rethink your PKI eBookThe Changing Role of PKI in your EnterpriseToday, the most prevalent use of PKI and digital certificates is secure web browsing, made possible through SSL/TLS certificates purchased from a number of trustedthird-parties known as public certificate authorities (CAs).Most organizations also deploy their own PKI in-house to issue certificates internally— known as a private CA or private PKI. No longer limited to a few use cases, privatePKI is now emerging as a core technology to secure business initiatives like zero-trust,multi-cloud, and DevOps.Web ServersInternet of Things (IoT)SSL/TLS certificates on external facingMutual authentication, encryption andweb and applications to enable trust.integrity controls for connected devices.Multi-CloudSecure EmailEphemeral certificates to authenticateDigitally sign and encrypt emails acrosscontainers, microservices, and workloads.corporate and BYOD devices.Network DevicesDevopsAuthentication between routers, firewalls,Signing containers and software builds,load balancers, and SSL inspectors.and securing ephemeral workloads.MFA/SSOMobile DevicesMulti-factor authentication for singleTrusted access for mobile apps, mobilesign-on applications such as Windowsbrowsers, Wi-Fi authentication, S/MIMEHello or Office 365.email encryption, and more.VPN AccessWi-Fi accessReplacing expensive VPN authenticationAuthentication to Wi-Fi connections tosolutions with password-free certificat-ensure that only trusted users are access-ed-based authentication.ing the network.PKI supports more than 11 differentapplications on average.222020 Global PKI and IoT Trends Study nCipher, an Entrust Company 2021 Keyfactor, Inc. All Rights Reserved www.keyfactor.com4

Rethink your PKI eBookGetting it Right: The Complexity of PKIDesigning, deploying and maintaining the necessary systems to support your ownprivate PKI can be a costly and time-consuming commitment. Even a single expiredcertificate can render the groundwork of your cybersecurity spend useless. Worse yet,if your underlying PKI is compromised, every certificate in your environment is rendereduntrustworthy. Getting it right is critical, but it is not an easy feat.ExpertisePKI is a multi-faceted system that requires specialized expertise and dedicated IT staff to plan, buildand manage throughout its lifecycle. IT personnel oroutside consultants will need to design the certificatehierarchy, develop policies and procedures, implementthe required software and hardware, create and test adisaster recovery plan, and track certificates throughouttheir lifecycle.Significant IT resources must also be committed tosupport ongoing maintenance of audit logs, certificatevalidation and revocation, IT training, and end-usersupport for users that leverage digital certificatesacross the business.InfrastructureA comprehensive set of infrastructure is required to runan in-house PKI effectively. High availability, backup,and disaster recovery must be carefully planned toensure continuous operation.Dedicated infrastructure will need to be procured andprovisioned to host the root CA, issuing CAs, revocationendpoints, enrollment processes, private key storage,and so on.Additionally, FIPS 140-2 validated Hardware SecurityModules (HSMs) must be configured to protect to theroot, policy, and issuing CAs. 2021 Keyfactor, Inc. All Rights Reserved www.keyfactor.com5

Rethink your PKI eBookSecurityIn the interest of saving time or avoiding operationaleffort, far too many PKIs get deployed with lower-thandesired security controls. But most IT and security teamsTHINK YOUR PKI IS FREE?don’t realize the impact if they lose control of their PKI,“Free” PKI capabilities included in serverif it’s compromised, or if it’s mishandled internally.operating systems can appear to be a simple,Because PKI supports business-critical applications,low-cost PKI solution, but the reality is thatsecurity must come first. Organizations without athere is far more infrastructure, security, andhighly secure facility, data center, and access controlsprocess involved.will need to invest in a higher security level to protecttheir PKI.Hidden costs and complexities mean IT andsecurity teams often overlook critical steps,Achieving appropriately high levels of security withinonly to find themselves months later with ayour existing IT infrastructure can be challenging andPKI far less secure and reliable than whenexpensive. The root CA is the anchor of trust in your PKIthey started out.environment. The integrity of your PKI relies entirelyon the security of the root CA, and requires highlyspecialized controls to be maintained effectively. Forstarters, adequate protection requires on-site security,continuous monitoring, highly trained personnel; securevault storage, hardware-level protection, multi-personauthentication, biometric controls, and of course, aproper root CA signing ceremony. 2021 Keyfactor, Inc. All Rights Reserved www.keyfactor.com6

Rethink your PKI eBookBusiness ChallengesIt’s clear that PKI is taking on a more important role in security, but there’s a number ofbusiness challenges that stand in the way of success.PKI Operations Under StressToday, PKI deployments initially built for one or twoapplications are now expected to cover more usersand devices than ever before. Demand for encryptionand authentication has increased pressure on legacyPKI systems that weren’t originally designed for thislevel of scale or complexity. As a result, integrity of thePKI typically degrades as new use cases are adoptedof organizationssay they havesufficient ITsecurity staffdedicated to PKIdeployment.3without consideration for the policies and proceduresset in place from the start.No Clear OwnershipLack of Tools & ProcessesPKI has always been a bit of a technical “hot potato.”Security teams might overemphasize focus on theThe sheer complexity of public key cryptography isinfrastructure and how to get certificates out initiallyenough to keep most IT professionals away. And if itand underestimate the effort dealing with pendingisn’t the complexity, it’s the risk. The consequences forexpirations and outage prevention. Without softwarefailure within enterprise PKI is considerable. Takingto handle the lifecycle of certificates, expirations andresponsibility for that level of risk leaves few inclined tooutages are inevitable, causing serious disruption totake on the challenge.business operations. Required audits also become difficult, expensive, and time-consuming.Limited Expertise & ResourcesDue to the intricacies of PKI, problems are likely to ariseunless you happen to have that knowledge withinyour organization, and equally important, the depth inpersonnel to be able to execute it properly. The numberof professionals specialized in the art of PKI is waning.Furthermore, it is not always considered a core operation within the enterprise.32020 Keyfactor-Ponemon Report 2021 Keyfactor, Inc. All Rights Reserved www.keyfactor.com7

Rethink your PKI eBookIn-House vs PKI as-a-ServiceWhen it comes to private PKI, you have two options: either build your own or adopt acloud-hosted PKIaaS solution. Build-it-yourself PKI isn’t impossible — the real questionis whether you want to spend the time, effort, and investment to build and maintain ityourself.In-House PKIPKI as-a-ServiceEnterprise designs, builds and deploys theirPKIaaS provider hosts and manages theprivate PKI infrastructure, assuming 100backend hardware and software required topercent of the risk and cost of implementation.run the private PKI and manage certificatelifecycles. You maintain control of the PKI.Trusting your PKI in the CloudEnterprises often limit their PKI deployment to components bundled into their operating system, but this mayprovide a false sense of simplicity. The real effort andexpense of PKI lies in its maintenance. Organizationsmust also consider how digital transformation willchange demands for encryption and authentication inthe future.Previous notions that security and control are bettermanaged in-house are changing. As IT environmentscompound, enterprises are putting their trust in aPublic-key infrastructure (PKI) anddigital certificates are hard tomanage. Organizations are alsoexpanding the use of PKI within IoTand DevOps pipelines. Technicalprofessionals need to transform theperception — and the deployment —of PKI to establish an automatedmanagement regime for PKI.”reliable PKIaaS partner. With dedicated PKI expertise at their disposal, proactive compliance coverage,and multi-layered security across infrastructure andoperations, PKIaaS providers can deliver a much moreGARTNER, THE RESURGENCE OF PKI IN CERTIFICATEMANAGEMENT, THE IoT AND DEVOPS, PAUL RABINOVICH,ERIK WAHLSTROM, 23 OCTOBER 2018effective, and ultimately more secure, PKI deployment. 2021 Keyfactor, Inc. All Rights Reserved www.keyfactor.com8