CryptographyIOTPKITLS

What is PKI and do I need one?

What is PKI and do I need one?

What is PKI and do I need one?

Public Key Infrastructure (PKI) is the physical hardware, software, and associated procedures and rules that deliver the security and trust for digital certificates and public-key encryption on networks. When web sites and web applications are secured using TLS/SSL via Server certificates, Intermediate Certificates, and Root Certificates such as those from Certificate Authority Entrust Datacard, it is PKI that maintains the trust chain. It does this by protecting the cryptographic keys in use within the certificate chain and if necessary, revoking a key if a certificate can no longer be trusted. In simple terms, PKI binds public encryption keys to identifiable entities such as businesses or individuals.

PKI has always played an essential role in the security of applications and networks. Its importance is increasing in the current age of accelerating use of connected devices and the Internet of Things (IoT). These devices need to be trusted, and their identities need to be confirmed before allowing access, in the same way, that people need identifying before granting access. Also, in the age of GDPR in the EU and CCPA in California, many online applications and services are increasing their use of PKI and encryption to secure data across the whole threat landscape. PKI is also a core requirement for protocols such as FIPS 140-2 and also the international security standard outlined in Common Criteria for Information Technology Security Evaluation.

PKI is a core pillar in all Internet-based security provision. Like all areas of security, doing PKI right requires expert knowledge that needs to be kept current to counter emerging threats, and to say up to date with changing legislation. Renaissance and nCipher (an Entrust Datacard company) can provide all the expertise, professional services, and products to deliver a robust and secure PKI to organisations and businesses of any size. Whether you have PKI expert staff on board already or not, contact us today to discuss your needs and to review your PKI. Read on for an overview of what nCipher and Renaissance can provide.

PKI Explained

The phrase you will see everywhere to explain PKI is a variant of this: "PKI is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption."

Read this excellent explainer page at the Entrust Datacard site for a detailed look at PKI.

PKI secures almost everything that occurs on the Internet. For example:

  • TLS/SSL certificates for public facing websites and services.
  • Private networks and VPN's.
  • Public cloud-based applications and services.
  • Email security.
  • Enterprise user authentication.

And much more!

nCipher Solutions

nCipher can provide solutions and products that will slot into any organisations existing IT and security infrastructure. From dedicated hardware devices to deliver PKI, through software solutions, to comprehensive training via Professional and consultation services, a tailored PKI solution can be designed and provided to meet any organisation’s needs.

Here is an overview of the hardware and software products available from nCipher and Renaissance:

  • nShield General purpose Hardware Security Modules (HSM) - dedicated hardware devices that are security hardened and designed to protect cryptographic keys. Various options are available depending on requirements and the deployment location within the network.
  • nShield as a Service - a fully hosted and managed subscription-based solution to protect an organisation's cryptographic assets. Let the nCipher experts take the PKI burden off the IT team.
  • nShield Software Option Packs - these add-ons provide additional functionality and deployment options that not all organisations will need. Options available are:
  • Web Services Option Pack - access nShield services via a REST-like API
  • nShield Container Option Pack - template to allow HSM support to be built into containerised application deployments
  • Time Stamping Option Pack - automate time stamp requests via a FIPS certified nShield HSM
  • Cloud Integration Option Pack - securely export HSM derived keys to Amazon Web Services or Google Cloud Platform
  • Database Security Option Pack - protect Microsoft SQL Server with nShield HSMs

nCipher Professional Services

The hardware and software solutions outlined above are backed by a dedicated Professional Services team within nCipher. This team has designed and implemented PKI for the world's most security-conscious organisations for the last few decades. The nCipher consulting team can work with any size of organisation to develop and deploy the right solution for any environment and ensure internal IT teams have the knowledge to manage and update it going forward. Ongoing contact can be maintained to ensure that organisations have access to the nCipher Professional Services team if needed.

The Professional Services team offer these services:

  • PKI Training - nCipher PKI Training equips staff to deploy and operate a PKI through its lifecycle. Designed for any team members involved in PKI operations, the training instils the skills needed to build and keep the PKI running as efficiently as possible. Training covers:

- A foundational understanding of today's cryptographic systems and PKIs

- Competence gained from real-world use cases and hands-on exercises

- Progressively learned skills—instructors work with students to evaluate their knowledge acquisition and build on each new topic

- Experience and confidence to begin managing PKI systems effectively

  • Enterprise PKI Deployment Service - the nCipher Professional Services team can help your business reconsider its approach to certificates and PKIs to support multiple use cases and applications. Often certificates are deployed on a per-application basis over time as more applications are deployed. This service can help organisations take a more holistic approach. The service delivers:

- Expanded functionality from your existing PKI

- A wide variety of PKI options to meet your business needs

- High confidence in your PKI solution afforded by thorough planning, documentation and testing

- Enhanced security through the deployment of nCipher hardware security modules proven over thousands of deployments

  • PKI Migration - the SHA-1 hashing algorithm previously used for signing PKI certificates is now considered unsafe. Organisations are migrating to the newer SHA-2, and all major browser vendors have stopped supporting SHA-1 signed certificates. Moving to SHA-2 is a complex problem due to the integral nature of hash algorithms within PKIs, as well as various industry and application incompatibilities with SHA-2. nCipher Professional Services can help you securely manage the complexities of this critical migration. nCipher's PKI Migration service provides:

- Expertise to help organisations efficiently select from migration options

- In-depth knowledge of known complications to help avoid pitfalls and mitigate risks

- Thorough upfront planning to minimise downtime

  • PKI Healthcheck - It's always good to get a fresh perspective on a security deployment, even with experts in PKI on staff. The nCipher PKI Healthcheck service can help with this by taking an independent look and ensuring that the PKI is deployed in a secure state and that it is optimally configured. A nCipher Professional Services consultant will analyse the technical aspects of the PKI along with the organisation's policy and governance rules, and provide both a written report and formal presentation of detailed findings and recommendations to management and IT departments. nCipher's PKI Healthcheck provides:

- Thorough and actionable advice to rectify issues and enhance the health of a PKI

- Comprehensive analysis extending beyond PKI technology to include policy and governance

- Expert counsel on security-enhancing hardware security modules

Conclusion

PKI is the bedrock that protects the digital certificates, that in turn protect the chain of trust that secures web applications and the browsers that access them. It is vital that the PKI in use within an organisation is configured correctly. nCipher and Renaissance can ensure that it is. Contact us today to find out more.