Keys and certificates under attack

The Ponemon Institute and Venafi have released the UK results of the 2015 Cost of Failed Trust Report, the only research of its kind to examine the Internet system of trust. The research, which is based on interviews of over 2,300 IT security professionals, reveals that 100 percent of UK organisations have responded to multiple attacks on keys and certificates in the past two years, with 54 percent noting that the trust established by keys and certificates that is necessary for online banking, shopping, and government is in jeopardy.

Conducted in the United Kingdom, Australia, France, Germany, and the United States, the report highlights that over the next two years, the potential financial risk facing UK enterprises from attacks on keys and certificates is expected to reach at least £33 million. Research findings highlight that security professionals fear a Cryptoapocalypse-like event the most. Coined by researchers at Black Hat 2013, a Cryptoapocalypse would dwarf Heartbleed in scope, complexity, and time to remediate.

“Whether they realise it or not, every business and government relies upon cryptographic keys and digital certificates to operate. Without the trust established by keys and certificates, we’d be back to the Internet ‘stone age’ – not knowing if a website, device, or mobile application can be trusted,” said Kevin Bocek, Vice President of Security Strategy and Threat Intelligence at Venafi. “The overwhelming theme in this year’s report is that online trust is at the breaking point. And it’s no surprise. Leading researchers from FireEye, Intel, Kaspersky, and Mandiant, and many others consistently identify the misuse of key and certificates as an important part of APT and cybercriminal operations.”

With the report emphasising that 63% percent of organisations do not know where all keys and certificates are located or how they’re being used, how can businesses have any trust in their online security? The research uncovered that attacks are becoming more widespread as the number of keys and certificates deployed on infrastructure such as web servers, network appliances, and cloud services has grown by 40% to almost 24,000 per enterprise over the past two years.
Russian cybercriminals, for instance, recently stole digital certificates from one of the top five global banks, enabling them to steal 80 million records, while another attack allowed hackers to steal data from 4.5 million healthcare patients. These are worrying figures when 60% of all surveyed respondents agreed that they need to do a better job at responding to vulnerabilities involving keys and certificates.

"With the rising tide of attacks on keys and certificates, it’s important that enterprises really understand the grave financial consequences. We couldn’t run the world’s digital economy without the system of trust they create,” said Dr. Larry Ponemon, chairman and founder of the Ponemon Institute. “This research is incredibly timely for IT security professionals everywhere – they need a wake up call like this to realise they can no longer place blind trust in keys and certificates that are increasingly being misused by cybercriminals.”

“Jeff Hudson, CEO, Venafi noted that this report should be seen as a red flag for security teams to recognise that the very core of their security processes is a breaking point, and the trust placed in these keys and certificates is waning. With no alternatives on the market, organisations need to prioritise the management and security of these crucial protective measures, and understand the risks associated with an attack.”
The 2015 Cost of Failed Trust Report also revealed:

??Security pros worry about a Cryptoapocalypse-like event: A scenario where the standard algorithms of trust like RSA and SHA are compromised and exploited overnight is reported as the most alarming threat. Instantly transactions, payments, mobile applications, and a growing number of Internet of Things could not be trusted. Coined by researchers at Black Hat 2013, a Cryptoapocalypse would dwarf Heartbleed in scope, complexity, and time to remediate.

As risk increases, so does the number of keys and certificates: The use of more keys and certificates makes them a better target for attack. Stolen certificates sell for almost a thousand pounds on underground marketplaces, and doubled in price in just one year. Researchers from Intel believe hacker interest is growing quickly and that stolen certificates will soon become the next big hacker marketplace.

The misuse of enterprise mobile certificates is a lurking concern: The misuse of enterprise mobility certificates used for applications like WiFi, VPN, and MDM/EMM is a growing concern for security professionals. Misuse of enterprise mobility certificates was a close second to a Cryptoapocalypse-like event as the most alarming threat. Incidents involving enterprise mobility certificates were assessed to have the largest total impact, over £79 million, and the second largest risk. With a quickly expanding array of mobile devices and applications in enterprises, it’s no wonder why security pros are so concerned.