Public Key Infrastructure – PKI

Over the past two decades the way we do business has significantly changed. In the early 2000s, Software-as-a-Service (SaaS) didn’t exist. Applications and security were provided by the organisation or enterprise, apps were inside a corporate network and users connected to the network via ethernet cable.

The world is very different now and the IT landscape has changed. Distributed workforces are the norm. To deal with this, businesses have implemented a mixture of in-house and cloud-based applications and infrastructure to provide access to data anywhere, at any time.

Data transmission must be secure and the only technology capable of providing complex, high security requirements is PKI.

To successfully set up a public key infrastructure, the following are paramount:

• Roles
• Policies
• Hardware
• Software
• Procedures

Installing technology is easy and CAs are often installed for individual projects without much thought, which is why many organisations suffer from certificate management challenges.

This issue can be solved with centralised trust infrastructure. It must be built to best practice with a standardised policy. Additionally, it’s important to use specialist technology, such as Hardware Security Modules (HSMs) to manage and secure certificates.

Guidance for PKI standardisation and minimum configuration requirements are provided by:

• International Civil Aviation Organisation (ICAO)
• National Institute of Standards and Technology (NIST)
• European Telecommunications Standards Insitute (ETSI)
• CA Browser Forum

Depending on your requirements, you may need to consider whether you need public trust, private trust or both. There are many Trust Service Providers (TSPs) who operate PKI and digital signature services to help organisations build and operate PKIs.

1. Central policy authority and centralised certificate service These will govern the issuance and management of keys and certificate, reducing non-compliant certificate issuance.These are industry standard documents that provide security and operational guidance on how the certificate services should be built, operated and how end entities should perform enrolment and renewals.
2. Certificate Authority (CA) hierarchyCertificate management teams should establish a CA hierarchy within the organisation. Built under the organisation’s security policy, the team would own a Certificate Policy and Certificate Practice Statement.
3. Establish preferred supplier(s)Organisations should establish a preferred supplier(s) for issuance of public or internet-facing Transport Layer Security (TLS) certificates and publicly trusted certificates to support digital signature services.
4. Proper planningA detailed PKI deployment plan is necessary. This plan should include the following elements:
   • PKI deployment goals
   • PKI use cases
   • PKI infrastructure requirements
   • PKI security requirements
5. Skilled resourcesPKI deployment and management are complex. It is essential for organisation to hire skilled resources or partner with experienced, trusted companies that have experience with PKI.
6. AuditRegular audits of your public key infrastructure are crucial. These help ensure your PKI is secure and compiiant with organisational security policies.
7. Secure storageOrganisations must ensure the certificate and key for the root CA is stored securely. This can be done using a hardware security module (HSM).
8. Use secure protocolsWhen communicating with public key infrastructure, it is vital to use a secure protocol such as TLS or HTTPS. It helps to protect your communication from eavesdropping or tampering.
9. Have a disaster recovery planIn the event of a disaster, it is essential for a PKI disaster recovery plan to be in place. This plan should include the steps to restore your PKI to working order.