PKI at the Crossroads: the Impact of the IoT and more! Amogh Ranade

Transcription

1 PKI at the Crossroads: the Impact of the IoT and more! Amogh Ranade

2 About this research 1,510 global respondents Covers US, Germany, India, UK, Brazil, Japan, Mexico, France, Arabia, Russian Federation, and Australia Part of Global Encryption Trends Study published in April 2017 Third year with PKI trends 2

3 Agenda Ongoing PKI challenges Increasing security maturity of enterprise PKIs Increasing influence of the IoT in PKI planning Takeaways 3

4 PKI state of the state Public Key Infrastructure Issues and manages digital certificates for applications Technology, policies, and procedures Standards and products stable but infrastructure implementation evolving Updated key lengths, algorithms Demands of new applications 4

5 How many applications does your PKI support? Continues to rise Complicates management Are initial conditions still true? 5

6 Applications that use PKI credentials Cloud applications on the rise SSL certificates for public facing websites and services Private networks and VPN 65% 84% These are core enterprise applications Downtime or loss of trust would have severe impact Public cloud-based applications and services Device authentication security Enterprise user authentication Private cloud-based applications Document/message signing Code signing 31% 56% 52% 51% 50% 44% 42% FY

7 Mixed bag for challenges to enable applications to use PKI 7

8 Increasing PKI security maturity

9 Practices to secure PKI and Certificate Authorities Shows increasing adoption of best practices Multifactor authentication for administrators 59% Physical secure location 47% Less out-of-the-box CA software use, more rigor Formal security practices (documented) Passwords alone without a second factor 29% 40% Offline root CAs 28% HSM use eclipsed password-only use for the first time! Isolated networks Strict record keeping (e.g., video recording, independent observers, etc.) 13% 21% 0% 10% 20% 30% 40% 50% 60% 70% 9

10 Where HSMs are used Offline root 42% 50% 48% Issuing CA 43% 45% 46% Online root 32% 38% 37% Policy CA Registration Authority OCSP responder Validation Authority 12% 10% 12% 9% 7% 5% 22% 23% 19% 30% 32% 27% HSM = Hardware Security Module Certified, trusted platform for crypto operations and key protection 0% 10% 20% 30% 40% 50% 60% FY 2017 FY 2016 FY

11 Approaches to certificate revocation 11

12 PKI deployment by industry sector Internal CA choice correlates with security maturity and heavier regulation 80% 70% 60% 50% 40% 30% 20% Similar results from regional analysis 10% 0% FS IM PS TS HP SV RT HL CM CP EU EM Internal corporate certificate authority (CA) 68% 55% 58% 50% 60% 49% 38% 55% 58% 45% 63% 45% Externally hosted private CA managed service 26% 32% 31% 39% 36% 26% 44% 35% 45% 58% 40% 48% Internal corporate certificate authority (CA) Externally hosted private CA managed service FS = Financial services IM = Industrial/manufacturing PS = Public sector TS = Technology & software HP = Healthcare & pharma SV = Services RT = Retail HL = Hospitality & leisure CM = Communications CP = Consumer products EU = Energy & utilities EM = Entertainment & media 12

13 Increasing influence of the Internet of Things (IoT) in PKI planning

14 Most important trends driving PKI deployment IoT is mirroring the rapid rise of cloud services Cloud-based services 54% 61% 64% 50% Logical given increased enterprise PKI leverage and security investment Consumer mobile Internet of Things (IoT) 21% 28% 41% 52% 40% Expect adaptations to fit IoT Regulatory environment 7% 23% environments 10% 0% 10% 20% 30% 40% 50% 60% 70% FY2015 FY2016 FY

15 Greatest areas of change for PKI planning/evolution 43% of IoT devices in use will use will use digital certificates in the next two years External mandates and standards New applications (e.g., Internet of Things) PKI technologies 14% 26% 26% 26% 36% 35% 48% 47% 56% PKI deployment will evolve to a combination of enterprise-based and cloud-based Management expectations Internal security policies Enterprise applications 28% 26% 21% 22% 18% 20% 30% 22% 19% 0% 10% 20% 30% 40% 50% 60% FY2015 FY2016 FY

16 PKI/IoT customer example Problem Prevent counterfeiting Enable secure device authentication Solution Embed keys and certificates at the time of manufacture nshield HSMs with CodeSafe working with Microsoft PKI Professional Services Similar customers include set-top-box manufacturers 16

17 PKI deployment/management challenges Ownership clashes and skill/resource issues have plagued PKIs for years No clear ownership Insufficient skills Insufficient resources 47% 42% 69% Too much change or uncertainty 41% All signs are that IoT projects are revealing very similar challenges Necessary performance and reliability is hard to achieve Lack of visibility of the applications that will depend on PKI Lack of clear understanding of the requirements 39% 35% 34% 0% 10% 20% 30% 40% 50% 60% 70% 80% FY

18 Takeaways

19 PKI is a critical investment today and tomorrow Increased adoption of best practices Multi-factor auth HSMs Certifications Planning and skills/resources important 19

20 PKI provides an important component of Trust for the IoT If you can t trust the data, there s no point in collecting it, analyzing it, or making business decisions based on it Trust starts at the device with authentication Code signing and encryption/key management address device integrity and data protection through an IoT ecosystem 20

21 Q&A Ponemon Institute Toll Free: Michigan HQ: 2308 US 31 N. Traverse City, MI USA Data security Container security IoT security Payments Cloud security Code signing PKI Thales esecurity Americas: EMEA: APAC: Key management App encryption Data encryption Hardware security modules Digital signing Tokenization data masking 21