The cybersecurity company Thales has published its 2015 PKI Global Trends Study. The report, based on research by the Ponemon Institute and sponsored by Thales, points to an increased reliance on public key infrastructures (PKIs) in enterprises, supporting a growing number of applications. At the same time, however, there is a general lack of clear PKI ownership, as well as a lack of resources and skills to properly support them. Current approaches to PKI are fragmented and do not always incorporate best practices, indicating a need for many to apply increased effort to secure their PKI as an important part of creating a foundation of trust.
More than 1500 IT and IT security practitioners were surveyed in ten countries: United States, United Kingdom, Germany, France, Australia, Japan, Brazil, Russian Federation, India and Mexico, with the aim of better understanding use of PKI.
Findings:
· The most significant challenge organizations face around PKI is the inability of their existing PKIs to support new applications (63 percent of respondents said this).
Only 11 percent of respondents say there is accountability and responsibility for PKI and the applications that rely upon it.
· A large percentage of respondents said they had no revocation techniques.
· Cloud-based services are the most significant driver for PKI-based application adoption.
· The level of visibility, influence and/or control over the applications that consume certificates managed by their PKI is minimal.
· There is a significantly higher use of weaker security techniques like passwords (53 percent) than there is of strong authentication mechanisms such as Hardware Security Modules (HSMs) (28 percent).
· The top three places where HSMs are deployed to secure PKIs are issuing certificate authorities together with offline and online root certificate authorities.
Dr. Larry Ponemon, chairman and founder of The Ponemon Institute, says: “On average, companies today are using their public key infrastructure (PKI) to support seven different applications. While the results of this study demonstrate some use of best practices, including strong authentication and hardware security modules, they also reveal that lower security options like passwords are still prevalent – which is concerning in light of the increased dependency on PKIs today.”
And John Grimm, senior director, Thales e-Security, says: “An increasing number of enterprise applications are in need of certificate issuance services, and many older PKIs are not equipped to support them. As organizations undertake a PKI upgrade cycle to support new applications and capabilities, many will look to improve the trust of their PKI by using HSMs to protect private keys for offline root certificate authorities as well as online issuing certificate authorities. Thales has decades of experience providing HSM-based PKI solutions, and runs a dedicated PKI Consulting Service to help businesses design and deploy world-class self-managed PKIs that build trust at the infrastructure level.”
