PKI Modernization

Overview of use case

The speed of innovation – whether forbusiness or for a government agency – is increasing in terms of new onlineservices, new combinations of goods, services, and partners, and new ways oflooking at the world. This speed arises from more specialized devices, moresophisticated workloads, and more interdependencies based on electronicinterchanges.

Devices critical to the organization areexpanding:

Cloud:Devices and workloads are increasingly beingmigrated to public and/or hybrid cloud environments.

On-premises: While the strategic direction might be the Cloud, for security orpragmatic reasons (such as prohibitive cost of migration), many devices andworkloads still remain on-premises.

Off-Premises: Increasingly, organizations need to support Work from Home andpersonal Bring Your Own Device (BYOD) pools of devices.  

3rdParty: Since efficiencies arise from integratingwith consultants, vendors, suppliers, and purchaser devices and workloads, 3rdparty devices and workloads are increasingly becoming part of theenvironment.  

‍

However, threat actors and online criminalsare increasingly taking advantage of the expanding security exposure surface toexecute a variety of attacks – such as Supply Chain, Adversary-in-the-Middle,and social engineering – that erode the digital trust that is absolutelyrequired for innovation.

Public Key Infrastructure (PKI) providesthe certainty and the ability for authentication to be automated at scale. Butmost PKI systems have been cobbled together over literally decades. Theoriginal architects have most often been replaced by high-priced consultants.As a result, most organizations do not have the deep PKI expertise needed tocreate a PKI infrastructure, to make it available globally, to operate itefficiently, and to maintain it over time.

A cloud-native PKI approach delivered as aservice is an ideal foundation for organizations to provide best-practicesmachine and interaction authentication in a reasonable timeframe and withoutbreaking the bank. This approach has the advantages of addressing hybrid needs(such as device validation and interaction validation) and providingconsistency across entire environment.

Theneed to innovate at speed requires a modernized and unified PKI across theorganization

‍

Challenges

To achieve the needs outlined above, thereare significant PKI challenges to overcome:

• New Uses and Needs:‍
  • Expanded Device Pool: Organizationswant to authenticate remote, WFH, and 3rd party devices.
  • Extend PKI to Virtual Entities: Organizations want to leverage PKI for Virtual Machine, Container,and other non-physical entity authentication – but legacy systems may not havethis capability.
  • Defense Against Targeted Attacks: PKI is the target of threat actor-led attacks but legacy systems arenot hardened.
• ExpertiseGaps:
  • Relianceon Consultants: PKI expertise is scarce today andso organizations rely on consultants.
  • CriticalInitial Configuration: PKI infrastructure must becarefully set up. An error can mean the entire stack needs to be rebuilt.
  • ComplexManagement: PKI ongoing management is complex. Pera 2020 study, most surveyed organizations spend $3 million annually to managetheir PKI implementation.
  • ServiceLevel Agreements: On-prem systems often strugglewith PKI availability. In fact, 83% of organizations had a PKI-related outagein a 12-month period.
• ChallengingEnvironment
  • HybridEnvironments: Many organizations will run a hybridcloud and on-premises environment indefinitely.
  • OutdatedComponents: PKI systems often include outdatedcomponents such as back level Microsoft CA systems that should be replaced forefficiency and for manageability.
  • BusinessUnits Interrelationships: Organizations often havebusiness units that need to be isolated from headquarters and each other yetneed to have trusted interrelationships.

‍

A modernized PKI is a must have

In summary, organizations need to modernizetheir PKI infrastructure with a SaaS approach. The approach should be able tohandle PKI for the organization along with semi-independent business units. Itshould also span all devices and workloads including 3rd party.

Since migration may be unfeasible for someapplications, the PKI system should support hybrid on-premises and cloud-nativemachines and workloads. The PKI should embrace new capabilities such ascertificates for emails and attachments as well as extend to future use casessuch as code signing.

Organizationsneed a Modernized SaaS PKI that that meets the need of Hybrid On-premises andCloud Environments

‍

Introducing Axiad conductor

Leveraging the power of the Axiad Conductorplatform, Axiad’s PKI as a Service (PKIaaS) is a consolidated, highlycustomizable, and scalable PKI for providing the digital trust required foryour organization to innovate and thrive. machine (device and workload) andinteraction authentication. Axiad PKIaaS provides highly secure certificates atscale and everywhere it’s needed – including partner, vendor, and Bring YourOwn Device (BYOD) machines. Emails and attached documents can be matched with acertificate of the end user, thereby verifying origin and non-repudiation ofemails. The combination of product functionality and the SaaS delivery modelhelps lower the cost of operating an in-house PKI and allows organizations toconsolidate or retire costly / aging existing PKI systems.

‍

Key features

• Consolidated: Serves all machine certificate needs, everywhere across theenvironment
  • Consistent:Generates certificates consistently across OSs,workloads, services, and more
  • Unified PKI: Consolidatesmultiple PKI components – typically multiple Certificate Authorities (CAs) –into a single comprehensive, scalable package
  • Full Coverage: Handlesall machines (including WFH, BYOD, and partner), workloads (VMs, Containers,etc.), and interactions (emails and attached documents) across the entireenvironment
• HighlyCustomizable: Fits into the most  complex environments
  • CustomCertificate Authority: CA topology, templates, andpolicies are customizable using both default templates and selectable templatesfor specific needs
  • Custom Certificates: Creates custom certificates and approval workflows without codingusing  customizable templates
  • Broad protocol support: Supports wide range of protocols, connectors, and standards for theautomated distribution and renewal of digital x.509 certificates
  • Integrated: Supportswide range of protocols, connectors, and standards for interoperation acrossthe Identity ecosystem​ out of the box
• Scalable:Works for any size organization
  • Seamless scalability: Cloud-based operations hosted by a major CSP in multiplegeographies provide seamless scalability
  • PKI without overhead: Offloads resource-intensive PKI setup, management, and maintenance
  • Ready Migration:Designed to make migration from on-premises PKI straightforward and withoutcompromise in functionality
• DeepPKI Expertise: Axiad provides PKI expertise toensure highly available and reliable operations
  • 24x7Operations: Operations and support are available ona 24x7 schedule
  • Maintenance and Upgrades: Maintenance is applied by the Axiad team to ensure stability of theservice and to upgrade functionality  
  • Services: Design,onboarding, and customization assistance is available from our ProfessionalServices team
• PlatformCapabilities: Leverages Axiad Conductor  Platform capabilities
  • Secure by Design: Customersreceive a Dedicated Instance for secure isolation
  • HSM: Customer rootkeys are stored in a HSM

Operation

Axiad Conductor PKIaaS runs in a dedicatedcloud instance for each customer. Within the instance:

• PKI Dashboard:Provides a single pane of glass for management of existing certificates, thecreation of custom certificates, and for configuring and managing theCertificate Authority.  
• Issuing Certificate Authority: Ensures that certificates are issued and validated at scale overthe cloud.
• HSM: Thecustomer’s root keys are consolidated into a HSM that is partitioned forsecurity.  

On-premises, off-premises (including WFHand Bring Your Own Device), and 3rd party devices and workloads areauthenticated by PKIaaS, wherever they are located. Utilities accessed from thePKI Dashboard make certificate provisioning efficient and rapid.  

How Axiad helps you

Axiad’s PKIaaS provides PKI CloudModernization with core capabilities that may not be possible with legacy PKIimplementations:

• Coverthe entire security exposure surface
  Span Work From Home (WFH), Bring Your OwnDevice (BYOD), and 3rd party machine authentication
• EnableNew Capabilities
  Enable new capabilities such as interactionauthentication and code signing
• Increase IT efficiencies across theauthentication landscape
Enhance operational efficiencies, manageSLAs, and minimize maintenance

Use cases

There are several major use cases enabledby a modernized PKI:

1. Consolidate all machine certificateneeds: In addition to physical devices, authenticate Virtual Machines,Containers, and other non-physical entities.  
2. Improve core SLAs / minimize ITresources: Cost-effectively migrate to the cloud for maximum coverage whileconserving precious IT resources.  
3. Enable new capabilities such as emailand attachment certification: Ensure that the sender is not impersonated andthe enclosure is not added by a threat actor.
4. Enhance IT efficiencies across theauthentication landscape: Instead of operating PKI as a silo, gain theadvantages of a unified cloud platform that also authenticates end users acrossthe entire ecosystem.

Each use case is outlined below.

1. Consolidate all machine certificate needs

Axiad Conductor PKIaaS consolidates allmachine certificate needs across the entire environment.  The package provides certificates to allmachines (including WFH, BYOD, and partner) and all workloads  (VMs, Containers, etc.).

Axiad PKIaaS has numerous customizationcapabilities to ensure that all organizational needs can be met with a singlesystem. The built-in customizable Certificate Authority can be modified interms of topology, templates, and policies. As compared to legacy CAs, theAxiad CA provides full capabilities but with increased efficiencies due toAxiad’s management utilities.

A wide range of protocols, connectors, andstandards are supported that enable efficient distribution and renewal of x.509certificates. Integrations with a wide range of protocols, connectors, andstandards enable interoperation across the Identity Ecosystem.

Advantages include the replacement ofoutdated PKI systems that are expensive to maintain, elimination of back levelversions of components such as Microsoft CA, and reduced IT effort.  

2. Improve core SLAs / minimize IT resources

For many organizations, availability andreliability of the PKI system is difficult to attain much less maintain. WithAxiad PKIaaS, operations are hosted by major CSPs in multiple geographies toprovide seamless scalability and to ensure localized regulations are moreeasily met. Maintenance is automatically applied by the Axiad team. Further,upgrades to take advantage of new identity fabric capabilities are alsoperformed by Axiad automatically and without charge.

Finally, a cloud-based portal providesefficient utilities for the management of certificate issuance, renewal, andrevocations. The portal provides warnings when certificates are nearing theexpiration date, thereby minimizing the chance of an expired certificatecausing an outage.

Advantages include the improvement ofservice levels for the PKI system, higher availability due to the reduction incertificate-related outages, and reduced IT effort.  

3. Enable New Capabilities

Axiad PKIaaS enables certificates to beleveraged in new capabilities such as certifying interactions. For example,interactions (emails and attached documents) can be certified to ensure thatthe sender is trusted and the attachment was not added by malware or a threatactor. Also, certification ensures that the email cannot be repudiated.

In addition, capabilities such as codesigning can be implemented with PKIaaS. Since it must work in sync with thedevelopment systems at the organization, it would require a customizedimplementation.    

Advantages include the direct reduction ofsocial engineering attacks, reduced rates of malware invading the environment,and greater flexibility in accommodating custom projects.

4. Enhance IT efficiencies across the authenticationlandscape

Instead of operating PKI as a silo,organizations can leverage a unified cloud platform that also authenticates endusers across the entire ecosystem. Sharing the Axiad Conductor platform, AxiadPKIaaS shares services with Axiad Certificate-Based Authentication (CBA). As aresult, end user authentication can easily be added across the organization.

By leveraging a combined PKIaaS and CBAapproach, the organization can enhance operational efficiencies, manage SLAs,and minimize overall maintenance. As an example, by efficiently managingcertificates across the organization, IT resource demands can be minimized.

Other advantages of a shared approach:

• Common mapping: End users and devices canbe mapped to the appropriate business entity efficiently and withoutconfusion.  
• Synergistic Authentication: The device canbe authenticated automatically before the end user authenticates, therebyincreasing security substantially.  
• Consistent Security Across Organization:Strong device authentication (PKI) can be matched to strong end user (CBA)authentication, keeping security consistently high.

Organizational outcomes

Strong positive outcomes are driven byAxiad’s approach:

• Expandbusiness opportunities: This approach safelyencompasses 3rd party and a wide range of devices and workloads into thesecurity ecosystem. As a result, partner offerings can be safely leveraged byorganization-owned resources, thereby maximizing potential businesssolutions.  
• ReduceBusiness Disruptions: As mentioned in theintroduction, PKI management and security issues result in business disruptionin terms of outages or breaches. With certificate expiration date tracking andprompting, business disruptions can be avoided. Further, due to a hardened PKIinfrastructure, breach risks are minimized.  
• MaximizeSecurity Flexibility: Legacy PKI most often onlyauthenticates resources that are controlled by the organization. With Axiad,security flexibility is maximized by enabling all devices and workloads to beauthenticated regardless of location or ownership.  
• ImproveEnd User Satisfaction: Today, end users often haveto respond to device authentication prompts. PKI machine authentication,despite embodying a more rigorous level of security, is automated andtransparent to end users. As a result, end user satisfaction will increase – awin-win for IT!
• IncreaseInnovation
• Leverage digital trust to innovate moreproducts and services and speed their delivery
• MaximizeSecurity
• Provide certificates to every component inyour infrastructure, closing doors for hackers
• MinimizeOverhead
• Minimize the labor and IT resourcesrequired to provide digital trust for your org

‍

Benefits for this use case

• Increase Innovation
  Leverage digital trust to innovatemore products and services andspeed their delivery
• Maximize Security
  Provide certificates to everycomponent in your infrastructure,closing doors for hackers
• Minimize Overhead
  Minimize the labor and ITresources required to providedigital trust for your org

‍

About Axiad

Axiad is an identity security companytackling the growing threat of compromised credentials, which  drive over 70% of enterprise breaches. Thesprawl of human and non-human identities across organization silos createssecurity blind spots that existing tools fail to secure. Axiad tackles thisproblem head-on, detecting identity risks and poor credential hygiene acrosssystems, providing actionable insights, and enhancing security without needinga complete overhaul. Axiad makes identity simple, effective, and real. Discovermore at axiad.com or follow us on LinkedIn.

‍

‍

‍

‍

‍

‍

‍

‍

‍