Default title

CERTIFICATES PROVIDE GREAT SECURITY

ONLY IF UNDERSTOOD AND IMPLEMENTED PROPERLY

Secure Certificates protect almost everything on the internet. Whether Symmetric or Asymmetric the foundational technology usually relies on a certificate or key. The key system is usually part of a set of private and public keys used for various purposes and relying on eachother for functionality.

Implementing a certificate is a very well documented process. In many cases it is too well documented and allows for less than qualified person's to effectively demonstrate a skill that they do not fully understand.

In an asymmetric key system the private key is never presented publicly, only public keys are presented to systems who wish to communicate with the target system. This is where a major security problem usually creeps into an otherwise secure system. Many times in my career I have noticed Private Keys left on the System Drives or desktops of mail servers, web servers and Linux Systems. These private keys are the kryptonite to good PKI. Keys should never be left unaccounted for or misplaced. They should be stored offline using secured, audited access methods. Gaining access to the private key of a secured system allows unfettered access to any encrypted communications using that key. This potentially allows access to emails, passwords, queries, bank information etc not because of a technical problem but instead because a lack of process and poor understanding of the technology. It is a purely preventable issue. If your key has been copied because it was left unsecured and is being used to read your encrypted communications there are very few tell-tale signs.

It might be tempting to let more junior people perform your key maintenance it is always advisable to leave anything regarding security safely in the hands of the experts who understand the technology.

RECENT THREAT POSTS

- Elizabeth Montalbano

Latest version of UnC0ver uses unpatched zero-day exploit to take complete control of devices, even those running iOS 13.5.

- Lindsey O'Donnell

Even seeing data breaches in the news, more than half of consumers are still reusing passwords.

- Tara Seals

A lack of awareness about where and how open-source libraries are being used is problematic, researchers say.

- Lindsey O'Donnell

Attackers used malicious Excel 4.0 documents to spread the weaponized NetSupport RAT in a spear-phishing campaign.

- Tara Seals

The meal-kit company's customer records were leaked as part of the Shiny Hunters breach.

- Tara Seals

An investigation traces an NSO Group-controlled IP address to a fake Facebook security portal.

- Lindsey O'Donnell

Government and air transportation companies in Kuwait and Saudi Arabia were targeted in a recent attack tracked back to the Chafer APT.

- Chris Calvert

Looking for niche anomalies in an automated way with AI and machine learning is the future.

- Lindsey O'Donnell

Cisco has fixed a critical remote code-execution flaw in its popular customer interaction management solution.

- Tara Seals

The malware-as-a-service is advanced, obfuscated and modular -- and built for mass campaigns.

Archives

Leave a Reply

Your email address will not be published. Required fields are marked *