Why 98% of orgs want to rebuild their PKI? PKI Automation

Outline

Keval Varia is a Senior Cybersecurity Solutions Engineer based in our San Juan Capistrano, CA head office

Keyfactor’s annual PKI & Digital Trust Report for 2024 contained a bombshell finding – 98% of organizations indicated that they would rebuild their public key infrastructure (PKI) if they could start over. While automation and cloud computing have advanced dramatically in recent years, many organizations have PKI’s that are stuck in the dark ages. An outdated, ineffective PKI is a major sign of clumsy crypto.

What is clumsy crypto?

Clumsy crypto is a term Accutive Security uses to refer o a range of inefficient and ineffective practices that are underlined by an inability to adapt to new technologies and algorithms without major disruption. Clumsy crypto in a PKI context refers to poor key management, neglected certificates, insufficient validation procedures, inadequate revocation policies and enforcement, and lack of PKI governance.

What are common PKI challenges and why are so many organizations unhappy with their PKI?

Public Key Infrastructure (PKI) is a critical, albeit often neglected part of many organization’s cryptographic framework. In 2024, automation and AI-driven efficiencies are solving more challenges every day, but PKI often appears stuck in the past. This year, our partner Keyfactor dug into the reason many organizations are unhappy with their PKI.

Common PKI Challenges

Keyfactor’s report revealed a number of critical PKI challenges that organizations are facing:

Lack of Foresight and Expertise: Many PKIs were built without a long-term vision for security, scalability, or flexibility. This leads to ad-hoc expansions and a complex, brittle system that struggles to adapt to modern demands.Additionally, high turnover in IT departments results in a loss of institutional knowledge, making it difficult to manage and maintain these complex systems.
Scaling Challenges: As organizations grow and embrace new technologies like cloud computing and IoT devices, their PKIs often fail to keep pace. The increasing volume of certificates and diverse use cases overwhelm legacy systems,leading to operational inefficiencies and potential security risks.
Manual Processes and Lack of Automation: Many organizations still rely on manual processes for certificate management, which is time-consuming, error-prone, and costly. This lack of automation hinders scalability and responsiveness, making it difficult to address certificate-related outages promptly.
Cloud Migration Complexities: While the benefits of cloud-based PKIs are evident, migrating legacy systems to the cloud poses significant challenges. Integration with existing infrastructure, data security concerns, and the need for specialized expertise often deter organizations from making the transition.
Compliance and Regulatory Hurdles: The constantly evolving landscape of industry standards and regulations necessitates continuous adaptation of PKI systems. Legacy infrastructures often struggle to keep up, exposing organizations to compliance risks and potential penalties.
Visibility and Governance Gaps: Many organizations lack a comprehensive view of their certificate landscape,making it difficult to identify vulnerabilities, track certificate usage, and enforce security policies. This lack of visibility hinders proactive risk management and can lead to security breaches.

These challenges are often compounded by a lack of advanced PKI tools, and PKI expertise within the organization. In many organizations, dedicated resources for certificate management and PKI are difficult to justify amid shrinking budgets and competing priorities. For these organizations, choosing a Managed Security Service Provider (MSSP/MSP) is often the most cost effective and efficient option.

What does it mean to ‘rebuild your PKI’?

Rebuilding your PKI refers to the process of redesigning an organization’s public key infrastructure. It is motivated by a desire to address shortcomings in the existing PKI system, such as a lack of scalability, security vulnerabilites, inflexibility, or poor efficiency. Common reasons for rebuilding PKI include:

The need to scale as machine identities and certificates grow
Regulatory compliance and risk management
Evolving cybersecurity threat landscape
Lack of automation capabilities and manual processes
Unmanageable and resource intensive
On premises PKI to cloud PKI (PKI as a Service) migration

What does rebuilding your PKI entail?

Rebuilding your PKI is not a mere software upgrade; it’s a strategic initiative to transform your cryptographic infrastructure for enhanced security, agility, and scalability. As a member of the PKI Consortium, Accutive Security leverages our collaborative work with other cybersecurity leaders to continually advance PKI tools and best practices, and apply these for the benefit of our clients. Our approach to PKI rebuilding is aligned with the five steps in the PKI Consortium’s PKI Maturity Model (PKIMM): Initial, Basic, Advanced, Managed and Optimized. Due to technical debt and limited resources, many organizations are stuck in the first two stages of the PKIMM: Initial and Basic. At Accutive Security, we work with our clients to reach at least the Advanced stage as an interim goal, before reaching a more mature Managed or Optimized PKI.

Leveraging the PKI Maturity Model (PKIMM) to Rebuild Your PKI

Assessment and Planning (Initial and Basic Stages)

Assess Current PKI State: Evaluate the existing PKI infrastructure, identifying weaknesses, inefficiencies, and security gaps.
Define Requirements and Objectives: Determine the goals for the new PKI system, considering scalability, security, compliance, and automation needs.
Risk Assessment and Mitigation Strategy: Identify potential risks associated with the transition and develop mitigation strategies to address them.
Develop a Roadmap: Create a detailed plan outlining the steps and timeline for the PKI rebuilding process.

Design (Advanced Stage)

Architectural Design: Design a robust PKI architecture that meets the defined requirements and objectives.
Selection of Technologies and Tools: Choose the appropriate technologies, software, and hardware that align with the new PKI design.
Compliance and Standards Alignment: Ensure that the new PKI design complies with relevant industry standards and regulations.

Implementation (Advanced to Managed Stages)

Infrastructure Setup: Set up the necessary hardware and software components for the new PKI system.
Certificate Policies and Procedures: Develop and document certificate policies, procedures, and lifecycle management practices.
Migration Plan Execution: Execute the migration plan, carefully transitioning from the old PKI system to the new one with minimal disruption.
Integration and Testing: Integrate the new PKI system with existing applications and systems, and conduct thorough testing to ensure functionality and security.

Management and Operation (Managed Stage)

Monitoring and Maintenance: Establish continuous monitoring and maintenance practices to ensure the PKI system operates smoothly.
Incident Response and Recovery: Develop and implement incident response and recovery plans to address potential security breaches or failures.
Training and Awareness: Provide training and raise awareness among staff to ensure proper use and management of the PKI system.

Optimization and Continuous Improvement (Optimized Stage)

Performance Optimization: Continuously optimize the performance and efficiency of the PKI system.
Regular Audits and Assessments: Conduct regular audits and assessments to identify areas for improvement and ensure compliance.
Innovation and Upgrades: Stay abreast of the latest advancements in PKI technology and continuously upgrade the system to incorporate new features and enhancements.
Feedback Loop: Establish a feedback loop to gather input from users and stakeholders, using it to drive ongoing improvements.

By following these steps, your organization can effectively rebuild your PKI to achieve a more secure, scalable, and efficient cryptographic infrastructure. At Accutive Security, we guide our clients through each stage of this process, leveraging our expertise and collaborative efforts with the PKI Consortium to deliver a robust and future-proof PKI solution.

Rebuilding and automating your PKI with Accutive Security

One of the most significant barriers faced by organizations is automating Public Key Infrastructure (PKI). The first step in automating your PKI is understanding your requirements and assessing your current PKI setup. Accutive Security offers PKI Assessments to help you understand the benefits and drawbacks of rebuilding your PKI, analyzing the feasibility and developing a concrete roadmap for a PKI rebuild. Next, you need to select the best PKI automation tools based on your needs.

What are the best PKI Automation Tools?

There is no one size fits all PKI automation tool that we recommend to every client. Accutive Security works with your teams to evaluate and select the best PKI platform for your organization’s needs. We partner with PKI leaders including Keyfactor, Venafi and HID, and our experts are certified to implement, integrate and manage their full range of PKI solutions.

Once you have your PKI automation platform selected, you should prioritize the workflows that you want to automate. For example, automated certificate issuance, automated certificate renewal, and automated policy enforcement. Additionally, you may wish to augment the automated workflows with a self-service portal to enable your users to request and manage their own certificates.