Story image

Four Major Misunderstandings about public key infrastructure (PKI)

21 May 18

There’s a misconception that public key infrastructure (PKI) is dead. While some circles believe we’ve grown beyond it, the reality is actually quite the opposite. PKI is not only still relevant, it will become more crucial in the future.

This is especially true as we explore more ways to manage and secure communications across an exploding number of new machines and applications.

Overall, it’s frustrating that PKI has been getting criticised for a while now, and it’s time someone set the record straight. Here are four major misunderstandings about PKI and why it’s needed for our future security:

#1: PKI technology is too old

Simply put, there is not a suitable replacement for PKI. As we adopt more cloud and DevOps infrastructure, we need PKI more than ever. Cloud and DevOps technologies use large numbers of certificates that are needed for short periods of time.

Only PKI can authenticate these certificates effectively and verify that data hasn’t been changed. Plus, it only costs a few cents. No one has been able to develop an alternative that offers these benefits.

#2: PKI is too complicated

Some people believe that PKI is incredibly complex. However, it’s often the management of PKI assets—keys and certificates—that’s causing the real pain. As a result, certificate issues can arise and take up large amounts of scarce, highly skilled resources.

You can avoid nearly all of these difficulties by simplifying PKI via automation of the management and workflow of the certificate life cycle. And don’t worry; this isn’t nearly as difficult as it seems.

#3: PKI is a back-office support technology

PKI was created for a specific purpose, and then it kind of went dormant for a while. “PKI 2.0” started about four or five years ago. That’s when certificates started being used on smart cards and other devices to identify humans as well as machines. Now our networks are exploding with machines that need unique identities. And PKI is still the only effective way you can tame, authenticate and protect all of these machines.

#4: PKI is an administrative tool

Executives often perceive PKI costs as unnecessary. But unmanaged machine identities can seriously impact your organisation. If a certificate and its corresponding keys are stolen, attackers can use them to feign trust. Once they’ve done this, they can move around inside your network completely undetected and do all kinds of malicious things. On the positive side, effective PKI management will alleviate these dangers.

So, what’s next for PKI?

Ultimately, PKI management is going to become a more critical component. The explosion of machines means that we’re putting a substantial number of keys and certificates on our networks. If you’re not consistently managing PKI, then you could be the victim of an attack by bad actors targeting keys and certificates.

As it is the foundation of all secure internet transactions, make PKI your best friend, not your worst enemy. It’s here for the long haul.

Click here to find out how Venafi can help you secure your PKIs.

Article by Venafi's regional director of Asia Pacific, Terrie Anderson.

Symantec releases neural network-integrated USB scanning station
Symantec Industrial Control System Protection Neural helps defend against USB-borne cyber attacks on operational technology.
SingleSource scores R&D grant to explore digital identity over blockchain
Callaghan Innovation has awarded a $318,000 R&D grant to Auckland-based firm SingleSource, a company that applies risk scoring to digital identity.
Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.
Spark Lab launches free cybersecurity tool for SMBs
Spark Lab has launched a new tool that it hopes will help New Zealand’s small businesses understand their cybersecurity risks.
Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.
Cylance makes APIs available in endpoint detection offering
Extensive APIs enable security teams to more efficiently view, enrich, and contextualise real-time intelligence collected at the endpoint to keep systems secure.
SolarWinds adds SDN monitoring support to network management portfolio
SolarWinds announced a broad refresh to its network management portfolio, as well as key enhancements to the Orion Platform. 
JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t.