If you were asked how many SSL/TLS and digital signing certificates your organization is using for data encryption, would you know the answer? If not, you're not alone.
The critical infrastructure that creates and manages encrypted connections is often overlooked or managed infrequently. Identity, once verified, forms the foundation for security. SSL and PKI encryption technology then authenticates identity, forming the critical foundation for securing both internal and external data transfers.
There are two key components to managing your complete certificate inventory: visibility and compliance. Let's look at how each of these underscores the importance of properly managing your certificates and keys.
Having a complete picture of where and how your certificates are being used reduces threats caused by unknown certificates that can be hidden throughout your IT ecosystem on endpoints or within your internal systems and applications. Such threats include system outages caused by expired certificates or vulnerabilities caused by server configuration errors.
Blind spots like these can add up to lost revenue from lost sales, brand erosion and loss of productivity while taxing vital resources in support and customer service. Here's an example from December 2018 when mobile network provider Ericsson had to pay $127 million in compensation to their customer O2 after an expired certificate caused a system outage that impacted more than 30 million mobile users.
The threat is real, as several other high-profile brands have publicly experienced. Check out this link to learn what happens when your SSL certificate expires.
There are guidelines that govern what constitutes a secure data transaction. These Data Protection Rules such as PSD2, GDPR (General Data Protection Regulation), and eIDAS in the European Union and PCI-DSS, HYTRUST, HITECH, California Privacy Act and CA/B Forum guidelines the United States establish a set of standards that all certification authorities must adhere to in an effort to safely transfer a user's personal data. Organizations can establish their own policies when it comes to encrypting internal data transfers on corporate PKIs.
While the threat is real, don't underestimate the importance of managing SSL and PKI properly. A comprehensive certificate life cycle management platform brings visibility to your certificate inventory, enabling you to stay in compliance and establish an effective way to provision, deploy, revoke and renew your certificates.