When operating an organization online, digital trust is paramount. Most businesses establish digital trust by securing their business and assets with Public Key Infrastructure (PKI) which demonstrates legitimacy and security of an identity using digital certificates. PKI is the foundation of digital trust, but how do you ensure that your certificates themselves are secure?
The trust of these certificates is established by digital alliances such as the CA/B forum, a series of protocols to keep these certificates in check, as well as the assurance of proper security management and best practices by organizations and Certificate Authorities (CAs) themselves.
Maintaining Trust through PKI requires proper key management in order to prevent certificates from becoming compromised, but this can sometimes become overlooked while IT and security teams focus on managing an ever-growing certificate inventory. We have compiled some simple best practices for businesses to follow when managing their cryptographic keys.
#1 Key Lifecycle Management
#2 Algorithms and Key Sizes
#3 Secure Storage
#4 Key Access Control
#5 Key Rotation
#6 Key Back-Up and Recovery
#7 Key Revocation and Termination
#8 Key Auditing
8 Best Practices for Key Management
#1 Key Lifecycle Management
Just like with digital certificates, key lifecycle management is important. Just as Certificate Lifecycle Management (CLM) ensures the provisioning, reissuance and revocation of certificates, your cryptographic keys also have a working lifespan and must also be provisioned for.
Ensure that your keys are stored in a centralized platform and integrate key management solutions as part of your key security management. This will allow you to protect and access your data, whilst preventing it from becoming lost. Automated solutions are best practice for this, as managing your keys manually using a spreadsheet is not scalable or centralized, whereas an automated solution can mitigate the risks of human error related incidents.
#2 Algorithms and Key Sizes
Key security corresponds directly to its size and the length of its encryption algorithm. The length of algorithm will also depend partially on its use, for example, a key for a digital signature will be different to a key for an SSL / TLS certificate.
The larger the key, the harder it is for a potential attacker to break, making it less likely to become compromised. Since 2015, NIST has recommended a minimum of 2048-bit keys for RSA (Rivest, Shamir and Adleman, who developed the method of public-key encryption). This was considered a significant update to the previously recommended 1024-bit minimum.
For most use cases, it is best practice to choose larger keys with longer algorithms to prevent them being broken and mitigate the risk of a breach.
#3 Secure Storage
While larger key sizes will prevent them from being broken, they will still need to be stored securely to ensure that they are not subject to access by the wrong individuals. As a standard, all keys should be secured in a cryptographic vault to prevent unauthorized access.
#4 Key Access Control
Access control goes hand in hand with secure key storage as while you want your keys to be accessible, you only want them to be accessible to the authorized users. Having broad key access will only make it more likely that it may fall into the hands of the wrong person and cause a data breach.
Cryptographic keys should have limited accessibility to ensure the accountability of those managing and using the keys. This will also make key access traceable in the case that it does become compromised, as well as generally providing limited access of the key to strengthen data security and integrity.
#5 Key Rotation
It is important to assign a dedicated crypto-period for each key. For key lifecycle management, your organization should implement a solution which allows you to easily set a validity period for each key and rotate their usage on demand. The longer a key is in use, it only increases its chances of being compromised. Similarly, using a key for multiple cryptographic processes also increases the chances of it becoming compromised.
#6 Key Back-Up and Recovery
Keys can sometimes become lost without necessarily being compromised and as such, it is essential that they are backed up. This can happen for several reasons such as a damaged or failed storage mechanism, which could result in data loss and potentially create vulnerabilities when a key is no longer accessible.
#7 Key Revocation and Termination
Key termination, revocation and renewal play an essential part of key lifecycle management. As with key rotation and validity periods, it is important to be able to easily renew cryptographic keys so that they are less likely to become compromised.
For key revocation and termination, it is also important to do this quickly and easily if a key becomes compromised. If a data breach should occur, you must be able to act fast to take the key offline and revoke access to any unauthorized key use.
#8 Key Auditing
Auditing is an important part of any security planning, and with cryptographic key maintenance, it is best to maintain the history of each key. This involves keeping an audit log that details key history from creation, to usage, renewal and deletion or revocation.
Some key management solutions allow scheduled reporting which helps maintain a clear picture of each key's history. This also helps with quick response times in the case of a breach where users can quickly locate compromised, lost, or expired keys, as well as maintain continuity of key management in the case of staffing changes or evolving industry requirements.
Maintaining Trust with Cryptographic Key Management
It is imperative to ensure cryptographic keys are protected and secure – if a key were to become compromised, and was not revoked in time, it could compromise business security and result in an incident.
Cryptographic keys are the foundation of PKI security, which is why organizations must prioritize key management and security as part of their overall security strategy. Maintaining key security is imperative for businesses to ensure digital trust and maintain business continuity. Ultimately, the very best practice for key management is to partner with a trusted Certificate Authority to implement secure, automated solutions which facilitate the secure storage and management of keys, as well as back-up, recovery, access control and rotation.
Editor’s Note: This blog was originally published in December 2021 but has since been reviewed to ensure that the content is in line with industry standards, regulations and insights.