A surprise too many, 100% of UK organisations have admitted that they have responded to multiple attacks over the past two years involving the foundation of online security – cryptographic keys and digital certificates – leaving security professionals concerned of a ‘Cryptoapocalypse’ if action isn’t taken soon.
The 2015 Cost of Failed Trust Report, released by The Ponemon Institute and Venafi, is the first research of its kind to examine the Internet system of trust. Over half of UK respondents (54%) recognise that the trust established by keys and certificates, the technology used to solve the first security issues of trust and privacy online, is in peril. Even more concerning is the remaining 46% who appear to be burying their heads in the sand when it comes to online security.
With 63% of organisations totally unaware of the location of their keys and certificates, and how they are being used, it is difficult to see how they, their customers, and their business partners could have any trust online. Without the trust established in keys and certificates, the Internet is right back in the ‘stone age’, with users unaware as to whether a website, device, or mobile application is secure, and if it can be trusted.
The potential risk facing each UK enterprises from attacks on keys and certificates, is set to hit a staggering £33 million over the next two years. It is imperative that an accelerated strategy to protect these keys and certificates is put in place, or security professionals in the UK could find themselves unpreparedly responding to a Crytoapocalypse, where the encryption algorithms we blindly trust are compromised, and organisations have no means to make bulk changes quickly. This could be catastrophic and would dwarf attacks such as the Heartbleed vulnerability in scope, cost, complexity, and the time it would take to remediate.
Duo Security RSAC 2015 – Register to win a free Quadcopter
With keys and certificates increasingly being misused by cybercriminals, and certificates fetching upwards of £700 on the black market, organisations should view this as a red flag. With no alternatives to keys and certificates on the market, businesses must prioritise protecting them. An immune system that finds all keys and certificates, determines which are trusted or not, fixes vulnerabilities, and changes and replaces them automatically, is needed to secure the system of trust that the UK and global economy depends on.
By Kevin Bocek, Vice President of Security Strategy and Threat Intelligence at Venafi
About Venafi
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.