Venafi, a global provider of machine identity protection, has announced the results of a study conducted by Dimensional Research that evaluates how prepared organisations are to respond to Certificate Authority (CA) errors and browser distrust events.
The study includes responses from eleven hundred IT security professionals who are knowledgeable about CAs from the U.S., U.K. and Germany, France and Australia.
Although IT security professionals are troubled by future CA incidents, very few have the tools needed to switch CAs quickly. For example, just fifteen percent of respondents believe that Google’s decision to distrust Symantec certificates is a one-time event.
However, if they were affected by a major CA event, only twenty-three percent said they are completely confident in their ability to quickly find and replace all their impacted certificates.
CA compromises and errors can leave organisations scrambling to find and replace many certificates in a short amount of time"
Replacing Symantec trust certificates
“CAs have a very difficult job and they deal with many complexities that are outside their control,” said Mike Dodson, global head of solution architects for Venafi.
“Every CA is exposed to risks; and CA compromises and errors can leave organisations scrambling to find and replace many certificates in a short amount of time. Organisations need greater control over the CAs they trust, but they also must acknowledge that they’ll never have full control. For example, browsers play a big role in how we trust CAs."
"Chrome and Mozilla recently decided they would no longer trust certificates issued by Symantec, and now many organisations must replace these certificates before a set deadline.”
Transport Layer Security certificates
Additional findings indicate that security professionals may be over estimating their ability to respond to a CA incident:
- Eighty-one percent of the respondents are concerned about future incidents involving CAs.
Chrome researchers announced a formal plan to remove trust from Symantec-issued certificates
- Sixty-one percent of the respondents say they have a plan in place that would allow them to replace all Symantec certificates by the upcoming deadlines, but only fifty-eight percent have an accurate inventory that includes the IP address of all devices where certificates that chain up to a Symantec root were installed.
- Nearly two thirds (sixty-two percent) are confident they don’t have certificates from unauthorised CAs but only half have controls in place to detect this.
- Seventy-four percent believe they can find and replace all certificates affected by a CA compromise quickly, but only eight percent have automated processes in place.
Last year, researchers affiliated with Google decided that Symantec, and their affiliated CAs, had mis-issued thousands of Transport Layer Security (TLS) certificates. As a result, Chrome researchers announced a formal plan to remove trust from Symantec-issued certificates. The first deadline is April 17th, 2018 when Chrome 66 and Mozilla will distrust Symantec TLS certificates issued prior to June 1, 2016.
