Citing the high-profile CA breaches last year, such as compromises at Comodo, DigiNotar, and others, NIST stressed the need for organizations to have a plan for CA compromises.
“Responding to a CA compromise may require replacing all user or device certificates or trust anchors. If an organization is not prepared with an inventory of certificate locations and owners, the organization will not be able to respond in a timely manner and may experience significant interruption in its operations for an extended period of time”, the NIST bulletin warned.
Paul Turner, vice president of product and customer solutions at Venafi and co-author of the bulletin, told Infosecurity that the most important thing for organizations is to know how to respond if a CA has been compromised. Organizations have a “major risk that has been highlighted by these attacks”, he said.
The bulletin explained that there are four ways in which CAs can be compromised: the attacker successfully impersonates someone else to the registration authority (RA) and is issued a certificate with that other person’s or system’s name in it; the attacker infiltrates the RA and is able to authorize the issuance of one or more fraudulent certificates by the CA; the attacker infiltrates the CA and succeeds in using the CA’s issuance system to issue one or more fraudulent certificates; or the attacker successfully gets a copy of the CA signing key and is able to use it to sign fraudulent certificates at will.
“The goal of the paper is to go through the scenarios so that if one of these happens, you know how to respond. Then we provided steps for you to prepare and respond” based on the particular scenario, he explained.
The NIST bulletin offered the following steps organizations should implement to prepare for a CA compromise: conduct an inventory of all certificates in the environment and identify owners, location, and issuing CA for these certificates; establish an inventory of all trust anchors – CA root certificates used to validate user and device certificates – and identify owners for these trust anchors; remove all trust anchors that should not be trusted; identify or document the procedures to replace each certificate; and identify backup sources for acquiring new certificates with appropriate policies.
Should a CA be compromised, organizations should ensure that certificates issued to the organization’s systems or users from the compromised CA are revoked, notify all owners of the affected certificates about the CA compromise and establish a point of contact for responding to questions and providing guidance and instructions, replace all certificates from the compromised CA with new certificates from a different CA, ensure that all relying parties have the certificate trust chains required to validate certificates from the new CA, and ensure that revocation checking is enabled on all relying party systems.
Turner recommended that private sector organizations put in place CA compromise plans “as soon as possible” given the recent breaches. He said that the next step for NIST would be to include these guidelines in the Federal Information Security Management Act (FISMA) requirements for federal agencies.