Building real trust in business applications

The worldwide cyber security landscape has seen a surge in the number of threats in recent years. When the global COVID-19 pandemic, bad actors accelerated this further, by taking advantage of a widened attack surface, as distributed and remote workforces became the norm, and users were working on a slew of unsecured devices, applications, and connections.

Unfortunately, security is always a catch-up game, and the cyber security tools and solutions being put in place by organisations, public sector entities, and individuals are increasingly being rendered obsolete by the growing sophistication of attackers.

In fact, a recent report by eSentire, predicted that the cost of cybercrime is set to hit $8 trillion this year, and will grow to $10.5 trillion by the year 2025. In addition, Juniper Research estimated that over 33 billion records will be stolen by cybercriminals this year, an increase of 175% from five years ago.

This is why controlling and managing access is the foundation of any robust security environment. This means enforcing principles of least privilege and making sure only the individuals with the appropriate permissions are able to access company data, enter business facilities, print confidential documents, and suchlike.

What is Public Key Infrastructure?

It is for this reason, that many companies are turning to public key infrastructure (PKI) to better secure themselves. PKI is effective because it increases worker and device trust by authenticating the identity of individuals, devices, and services. Moreover, it offers a layer of protection against the spoofing and phishing of those same devices, users, and services.

At its heart, PKI is the set of hardware, software, policies, processes, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates and public keys. PKI uses key pairs and certificates to verify the identity of users and systems. These digital certificate link the name of a person to their specific public key. Over and above the public key, certificates also contain extra data, such as its intended purpose, the issuer, and other types of metadata.

A PKI environment assigns a digital identity for each and every employee and computer, facilitating secure access to data, networks, as well as physical locations.

Managed PKI

In the past, PKI was done by tracking secure socket layer (SSL) certificate usage on spreadsheets. SSL is the standard technology used to keep an internet connection secure and protecting any sensitive data that is transferred or sent between two systems, preventing malefactors from reading and modifying any data transferred, such as personal details or proprietary information.

However, keeping track of tens or even hundreds of certificates in a server environment is a monumental task, and can rapidly become unmanageable for the IT staff tasked with enterprise security.

Furthermore, as with all cyber security solutions, the ability to rapidly secure manage users and authenticators is crucial, so doing this talk manually was ineffective and impractical. For this reason, many forward-thinking companies are turning to a trusted partner to handle this function for them.

It is important to remember though, that not all managed PKI services are the same. The vast majority of Certificate Authorities will charge thousands of rands to use mPKI before the company has even issued one single SSL Certificate.

Additionally, a lot of SSL providers’ managed services mean the business needs to buy a whole lot of credits that expire if they are not used, meaning the organisation is paying for a service but getting nothing in return.

The Altron Systems Integration difference

Managed PKI (mPKI) from Altron Systems Integration offers a wide range of benefits. The company offers managed PKI for its clients, using a state-of-the-art data centre and its own team of highly experienced security professionals, eliminating the need for them to build and maintain an expensive and resource-heavy in-house PKI solution.

The plusses are many. For starters, entities can enjoy more rapid certificate issuance and automatic certificate deployment. Other benefits include custom certificate request approval rules and a lower total cost of SSL ownership. Best of all, all of these benefits come on a publicly trusted root compatible with all major browsers and operating systems, which removes the need for self-signed certificates and any “certificate not trusted” errors.