Certificate-Related Outages Impact Most Businesses
March 01, 2017

Pete Goldin
APMdigest

Share this

Certificate-related outages negatively impact the reliability and availability of vital systems and services, according to a new study by Venafi.

“Certificates and keys are identity and access management for machines, just like user names and passwords are for humans,” said Kevin Bocek, VP of Security Strategy and Threat Intelligence at Venafi. “Certificates allow machines to communicate securely and that makes them an essential, but underappreciated, part of every organization’s digital ecosystem and our global digital economy. When certificates expire unexpectedly, critical services can be impacted. Unfortunately, most businesses do not have the visibility or tools necessary to manage this fundamental element of cyber security and operational availability effectively.”

The primary study findings include:

■ The majority (79 percent) of respondents suffered at least one certificate-related outage in 2016.

■ Over a third (38 percent) suffered more than six certificate-related outages in 2016.

■ Almost one in twenty (4 percent) suffered 100 or more certificate-related outages in 2016.

■ Almost two-thirds (64 percent) said their organizations could not respond to a certificate-related security event in six hours or less.

As the use of encryption explodes, the challenges connected with effective key and certificate management have proliferated. Recent research showed dramatic growth in the use of keys and certificates, especially among large organizations.

One of the primary drivers behind the surge in certificate usage is the explosion in the number of IP-enabled devices on business networks. Another challenge organizations face is the adoption of DevOps and Fast IT development processes that dramatically increase the number of certificates needed. This increase in certificates and their corresponding keys compounds the serious security vulnerabilities associated with cryptographic key and digital certificate mismanagement.

Many businesses are still unaware of the scale of this problem. Venafi customer data shows that the average organization found over 16,500 unknown keys and certificates of which they were not previously aware. Also, the new study shows that most companies do not have control over their key and certificate inventory, do not have an automated process for renewals and have no central record of when certificates are due to expire:

■ Almost two-thirds (65 percent) of organizations do not manage all their keys and certificates centrally.

■ Of those that do manage certificates centrally, 65 percent rely on security controls from their Certificate Authorities (CAs), which limit their visibility to certificates provided by the issuing CA.

“The good news is that certificate-related outages are completely preventable, but you need to understand the scale and the scope of the problem,” continued Bocek. “As we use more cloud services, IoT devices and DevOps automation, certificate usage is skyrocketing. To keep up with this expanding problem, organizations must automate the discovery, issuance, lifecycle, and remediation of all keys and certificates from the data center to the cloud to the IoT edge of their networks. Failure to do so puts the reliability and availability of critical services at risk and dramatically increases cyber security risks.”

Share this

The Latest

September 19, 2017

IT professionals tend to go above and beyond the scope of their core responsibilities as the changing business landscape demands more of their attention, both inside and outside of the office, according to the Little-Known Facts survey conducted by SolarWinds in honor of IT Professionals Day ...

September 18, 2017

Digital video consumption is viral and, according to a new study released by IBM and International Broadcasting Convention (IBC), more than half of the 21,000 consumers surveyed are using mobiles every day to watch streaming videos, and that number is expected to grow 45 percent in the next three years ...

September 15, 2017

No technology that touches more than one IT stakeholder, no matter how good and how transformative, can deliver its potential without attention to leadership, process considerations and dialog. In this blog, I'd like to share effective strategies for AIA adoption ...

September 14, 2017

Enterprise IT environments are becoming more heterogeneous and complex, with fragmentation permeating cloud infrastructure, tooling and culture, according to a survey recently conducted by IOD Cloud Technologies Research in partnership with Cloudify ...

September 12, 2017

One area that enables enterprises to reduce complexity and streamline operations is their virtual desktop infrastructure (VDI). Virtualization is a linchpin of digital transformation and effectively optimizing an enterprise's VDI is essential to moving forward with digital technologies. Delivering the best possible VDI performance means taking a fresh look at what "desktop" means today. The endpoint, or desktop, now can be a physical thin client, a software-defined thin client, a traditional laptop, a phone or tablet. To reduce operational waste and achieve better performance across the desktop environment, consider these five actions ...

September 11, 2017

In incident management, we often overlook the simple things in favor of trying to do too much, too soon. Why not make sure we've done the fundamentals properly? ...

September 08, 2017
For our Advanced IT Analytics (AIA) Buyer's Guide, we interviewed more than 20 deployments to help us better assess vendor strengths and limitations. So given the abundance of riches to work with, I've decided to illustrate several of the more prominent AIA benefit categories with actual real-world comments ...
September 07, 2017

The Input/Output Operations per Second (I/O) capabilities of modern computer systems are truly a modern wonder. Yet no matter how powerful the processors, no matter how many cores, how perfectly formed the bus architecture, or how many flash modules are added, somehow it never seems to be enough ...

September 06, 2017

By taking advantage of performance monitoring, IT and business decision makers can gain better visibility into their cloud and application performance. Dedicated performance monitoring has become essential for providing visibility into all areas of application performance and keeping the business running optimally ...

September 01, 2017

There may be no more critical emerging technology for IT organizations in the digital age than advanced IT analytics (AIA) — most commonly called “operational analytics.” It is with this in mind that EMA is launching what we believe is the first ever buyer's guide for AIA adoption ...