Secure Critical Information

Analyst Coverage

"Admittedly this is a complex topic, but the most important takeaway is this: the risk-based evaluation your company needs to make right now is not about your vulnerability to the Flame virus; it is about your vulnerability to MD5-signed certificates. If you are confident in knowing how many of these there are, and where they are, and what systems are potentially at risk as a result – well done." Full Report

"Organizations with roughly 200 or more documented X.509 certificates in use are high-risk candidates for unplanned expiry and having certificates that have been purchased but not deployed." Full Report

"To support the broader deployment of encryption, organizations with top performance have looked towards increased automation and centralized, heterogeneous approaches to key lifecycle management. Venafi is well-aligned with this Best-in-Class approach."

"Venafi's primary differentiator is its broad entity support for systems that utilize asymmetric keys and certificates. In addition, it implements flexible key lifecycle policies and administration functionality and automated discovery of keys and certificates in systems that support such activity."

"Venafi offers compelling advantages, such as being the early mover in this market, with proven deployments at marquee customers demonstrating its ability to scale and provide breadth of integration."

"When there are many hundreds of certificates from a variety of certificate authorities, the only ecumenical [universal], nonproprietary provider of a certificate management solution is Venafi. Other CA management systems are biased toward the particular CA by, for example, only supporting renewals from that specific CA." Full Report

"The emphasis on orchestration, in tandem with its scalability and interoperability, is tied to the evolution of Venafi's competitive landscape, and to the potential to frame its value in the context of risk management."

Inadequate key and certificate management invalidates encryption efforts

With sensitive data—and threats to that data—increasing exponentially, companies struggle to implement comprehensive encryption. Unfortunately, deploying increasingly expansive volumes of encryption without simultaneously increasing staff or resources to manage the impacted systems and assets exposes new security threats, all while increasing the risk of compromise and noncompliance the encryption deployments originally aimed to avoid.

Because encryption means nothing unless keys remain secret, the data that companies believe is protected remains woefully exposed. Only best key and certificate management practices, made possible and painless by an automated solution, truly protects vital data.

Manual management processes expose keys to compromise

To protect encryption keys, administrators must follow clear, well-documented processes that minimize the keys’ exposure. Most company’s manual key management practices fail to measure up:

Keys have multiple access points
Keystores passwords are not changed regularly
The same password is used across multiple keystores
Private key(s) are manually shared between administrators and applications
Distribution policies are lax or unclear
Private keys and passwords are not changed when admins leave the organization
Expansive key and certificate volumes leave glaring gaps in coverage

With so many points of exposure, dozens of people can access thousands of keys. The typically high IT staff turnover magnifies the risk of a compromise.

Poorly managed encryption assets give rise to serious security issues

Consider the devastating consequences of a compromised key:

A compromised symmetric key exposes the company to data breaches
A compromised private key (associated with a server’s digital certificate) exposes the company to data breaches, phishing attacks and malware
A compromised SSH key exposes the company to data breaches and other attacks