Late last year the Stuxnet made international headlines by infecting computers at an Iranian nuclear power plant. Much of the coverage has been focused on speculation as to who was behind the malware, which appeared to be designed specifically to target nuclear power plants with certain types of equipment. But how were the creators of Stuxnet able to infiltrate a high security nuclear power plant? According to Symantec, one of the key components in the attack was a legitimate digital certificate. The attackers either stole a private key, or were able to get their files signed. How can you keep your digital certificates and encryption keys safe?
Venafi is a company that sells a product for managing digital certificates and encryption keys called Venafi Encryption Director. Today, it released a new version of its product. According to a market survey conducted by Venafi of 471 management and C-level respondents:
- 51 percent stated they had experienced either stolen or unaccounted for digital certificates, or that they were uncertain if their organizations had lost, stolen or unaccounted for digital certificates in general
- 54 percent stated they had experienced either stolen or unaccounted for encryption keys, or that they were uncertain if their organizations had lost, stolen or unaccounted for encryption keys in general
- 46 percent of organizations are managing at least 1,000 digital encryption certificates; 20 percent are managing more than 10,000
- 83 percent of organizations are managing technologies from at least two different CAs; 18 percent are dealing with more than five
- 88 percent of organizations have multiple administrators managing encryption keys; 22 percent have more than 10
- 42 percent or organizations manage encryption technologies from at least four vendors; 8 percent are dealing with more than 10
In an essay on Stuxnet, Venafi CEO Jeff Hudson writes in apparent reference these survey results:
Here’s a parallel analogy in the world of physical security. This is exactly the same as not knowing which people in a secure building are authorized to be on the premises and which are unauthorized. Imagine a bank where no one knew which people in the building were authorized to be there or not. This is not an exaggeration. This is an unacceptable situation to anyone who takes security seriously. This is an unquantified risk.
Stuxnet demonstrates the importance the damage rogue certificates can do. Encryption keys don’t do much good if they are lost or stolen. Whether you use Venafi’s solution or something else, you need to have a plan.
Symantec PGP TrustCenter competes with Venafi Encryption Director.
