5 Hidden Costs of Certificate Management
5 Hidden Costs of Certificate Management
Every organization is looking for ways to drive costs down. Certificate management, or what we like to call machine identity management, is no exception. But in many organizations, keys and certificates tend to be viewed as a fixed cost. So, no one is looking too closely at areas where they cost more than they should.
Pervasive automation initiatives may well change that perception. In other areas of the business, organizations are looking to automate all kinds of processes to improve efficiency and lower costs. This is certainly true in DevOps and in data center infrastructures, where organizations are moving toward modern infrastructures because they make it possible to leverage higher levels of agility and automation. The intent of these big initiatives is to drive human costs out of the business.
Once organizations realize the potential savings, certificate management is a prime candidate for automation. One Venafi customer recently did a rudimentary, back-of-the-envelope calculation and came up with a cost savings of $275,000 per year after automating certificate management. But there are also some hidden cost savings that you should consider if you’re looking for ways to make you IT infrastructure more automated. I’ve outlined five of the most common, but often unrecognized, costs of certificate management below:
- Hidden Cost #1: You’re paying more than you think to provision certificates.
Simply put, it takes more staff hours than you’d like to imagine simply to provision certificates. When you look at the time it takes to physically do a CSR, request the key, download it, format it, physically install it, you’re looking at four to five hours of manual effort. If you automate the full lifecycle of a key, you can take the human element out of the equation. To put that value into perspective, let’s say you are one of the 25% of organizations that have at least 10,000 certificates. If you knock out four of the five hours in the lifecycle of each one of those, you’ll save 40,000 staff hours. Multiply that by a conservative hourly rate of $75 for a fully burdened IT professional and you’re talking real money. $3M to be exact.
- Hidden Cost #2: You’re losing money every time you have to stop to fix a certificate outage.
Unplanned certificate-related outages are not just a nightmare to fix, they are a costly. Not only do you have to pull resources from other projects to troubleshoot the outage, then locate all instances of the expired certificate and replace it with a new one, you also take substantial hits on availability and. And if the certificate outage impacts an externally facing system, you could see revenue, customer satisfaction and loyalty losses as well. If you automate the entire certificate lifecycle, you can save all of that headache and hidden costs of certificate outages by setting up your automation so that certificates are automatically replaced well before they expire.
- Hidden Cost #3: You may be slowing down revenue generating business functions.
If it takes you too long to provision certificates for critical business functions, you could lose potential revenue. Here’s an example from the load balancing team at one of our customers. It took them five days to get a certificate and stand up an image using manual processes. This five-day SOA significantly impacted their ability to deliver a vital business service. By automating this process, they were able to stand up a new image and make it secure in 10 minutes. Think about the amount of time that saves, and the agility to be able to spin up infrastructure and spin down infrastructure during peak seasons. There's tremendous business value in that.
- Hidden Cost #4: You may be paying too much to fix avoidable audit findings.
Corporate, government, and industry policies and regulations, are beginning to include standards that focus specifically on key and certificate management. The most common audit findings include an incomplete inventory of keys and certificates, the use of unauthorized CAs, expired certificates, and unrestricted use of self-signed certificates. If you’re tasked with addressing these negative compliance findings, you may face a lengthy, manual project. But if you’ve automated your certificate management, you can significantly reduce these business risk by automating continuous compliance with all security policies. And this will drive cost out of your audit process too.
- Hidden Cost #5: You may be robbing resources from more strategic programs.
Resources are tight in every organization and security teams are always fighting for all the budget they can get. If you can free up thousands of staff hours by automating your certificate management, then those are hours that you can reallocate to other projects. There's two upsides to that equation. One is, you'll save the money because you don't have to go out and hire people (or you can downsize). The other piece of that equation is that you don’t require additional people as your use of certificates expands in response to cloud, DevOps and IoT initiatives. The ability to knock resource hours out of your IT and security workloads is huge.
I’ve focused on the cost savings of automating certificate management but this is only one way to look at the benefits of automating key and certificate lifecycles. In my opinion, that’s just one small piece of the benefits. When you automate machine identity management for keys and certificates, you get all the operational benefits while reducing the attack surface for threats that leverage encryption.
Organizations face a real problem securing all of the keys and certificates that act as protect machine identities. And it’s costing them too much to do it without automation. That’s why I love telling CIOs, "Hey, I'm going to make you more secure, and oh, by the way, I'm going to drive about 100 to 150 thousand dollars a year out of the cost of managing certificates."
How much can you save by automating your machine identity management?
Learn more about machine identity management. Explore now.
Related posts
Like this blog? We think you will love this.
Exposed TLS Certificates Force PKI Lead to Quit: How Badly Managed PKI Poses Serious Risk [Case Study]
'I'm out of here' — PKI lead That’s th
Read More
About the author
Mark Thatcher
Mark Thatcher is Director of Sales, South & Central Region, at Venafi. He works to find innovative solutions to provide the Global 5000 with Next-Generation Trust Protection in the evolving landscape of Machine Identity Protection.
Read Posts by Author
