In today’s digital landscape, organizations need help achieving visibility and control over their digital keys and certificates.
The average enterprise manages 255,000 certificates and keys, often spread across several business units. Managing them in silos through manual processes costs teams significant bandwidth and poses the potential for downtime.
Perfecting Public Key Infrastructure (PKI) and Certificate Lifecycle Management (CLM) doesn’t happen overnight, nor is it a one-and-done effort. According to Keyfactor’s 2023 State of Machine Identity Report:
- 77% of organizations admit that digital certificates continue to cause unplanned outages and downtime.
- Less than half of organizations have an overall machine identity management strategy applied consistently across the enterprise.
- 62% of organizations don’t know how many keys and certificates they have.
There are five stages of CLM maturity outlined in Keyfactor’s Certificate Lifecycle Management Maturity ebook. This blog explores Level 1 and Level 2, which many organizations will likely find themselves in. To get a deep dive into what it means to be a Level 3 or 4, and get a sense of what a fully mature CLM practice looks like in Level 5, download the CLM Maturity Model eBook.
Level 1 - Manual CLM
At Level 1, teams are struggling to tackle the increasing volume and sprawl of certificates across the organization, largely because they are performing CLM with heavily manual processes.
Level 1 teams manage certificates through manual workarounds like spreadsheets, calendar reminders, or scripts to notify certificate owners about impending expirations. There is no automation, and maintaining PKI resources is time-consuming and error-prone.
The caveat with manual, spreadsheet-based PKI management is that it depends on staff knowing where to check for existing certificates. Unknown and untracked certificates still pose a threat. As the volume of machine identities grows and recommended certificate lifecycles shorten, Level 1 becomes much less tenable to sustain.
Organizations at Level 1 should take stock of their certificate and PKI landscape to identify workflows that could be easily automated and begin establishing an organization-wide process around keys and certificates.
Questions to ask
- Which business units and applications rely on certificates?
- How many certificate authorities (CAs) are actively issuing certificates in our environment, and how many are in use?
- How much time is spent issuing and updating certificates across all departments?
Level 2 - Siloed CLM
Level 2 organizations have made great strides in managing known certificates by evolving away from manual processes. However, the threat of an undetected certificate lurking in the system’s depths is still very real.
Because certificate management is spread across departmental silos and disparate toolkits, visibility and reporting are still fragmented and siloed.
To solve the problem, teams should endeavor to improve their discovery capabilities. They need network-based discovery and local discovery tools (i.e., agents and orchestrators) to find where certificates reside in the network, which applications use them, and where the private key is stored.
The real goal here is centralization. Not only does centralizing CLM across the organization enable greater visibility and control, it also consolidates ownership of CLM and aligns governance and best practices across the organization.
Questions to ask
- How many reports does it take to create a holistic view of CLM across multiple CAs? Which reports are missing?
- If a certificate is near expiration, how do we ensure the owner will renew it in time?
- Do I know where each certificate is used, or do I just know where it was issued from?
Jumping ahead to Level 5 - the pinnacle of CLM
In the fifth and final level of CLM maturity, organizations have achieved zero-touch CLM automation and true crypto-agility. Level 5 organizations have established a complete inventory of all certificates in their environments, regardless of the certificate’s source or destination. Even if a small percentage of certificates remain unautomated, 100% of certificates are known.
At Level 5, secure PKI is baked so deeply into the DevOps workflow that it is practically invisible and unobtrusive to developers. Silos of PKI usage have been completely dismantled. Information security teams play an active role in the DevSecOps fabric, helping engineers raise the bar on quality, speed, and security.
If Level 5 feels impossibly far away, don’t worry. Focusing on maturing from one level to the next will help you reach a fully mature CLM in the most efficient way possible.
Initiating the evolution of CLM
To kickstart the evolution of CLM within your organization, consider the following steps:
- Build Your Team: Begin by assessing which stakeholders are involved in CLM and bring them into the process. Collaboration and communication among teams are essential for successful CLM management.
- Understand Use Cases: Gain a comprehensive understanding of the various use cases that require CLM within your organization. This knowledge will aid in identifying critical areas that need attention and improvement.
- Map Your CLM Infrastructure: Create a detailed map of your entire CLM infrastructure. This exercise will clarify your CLM’s existing state and identify areas where enhancements are necessary.
- Track Progress: Develop a plan to track your progress to CLM maturity. Establish measurable milestones and continuously evaluate your advancements, making adjustments as needed.
Any organization can reach the highest form of CLM maturity — and they’ll need to, to stay ahead of increasing certificate volume and use cases, as well as emerging security threats.
Level 1 and Level 2 are meant to triage the inefficiencies plaguing teams and discern an organization-specific vision for CLM maturity. Level 3 and Level 4 bridge the gap to a scalable, resilient CLM practice.
No matter where an organization stands in its CLM maturity, theCLM Maturity Model ebook can provide a roadmap to help reach the next step.
By embracing automation, fostering collaboration, and implementing robust CLM practices, organizations can build a solid foundation for future certificate management policies.
