Certificate & Key Audit | Venafi Skip to main content


<---Back to Education Center

Compliance Audits




7 Actionable Steps to Audit and Remediate Keys and Certificates



Keys and Certificates are a vital part of any companies security infrastructure and need to be regularly audited to maximize their effectiveness.This will give you the steps to audit and remediate your keys and certificates within your environment.

1.    SSL and SSH policies in place and annually reviewed
2.    System-generated inventory of keys and certs
3.    Keys and certs are compliant with policy
4.    Private key management processes reviewed
5.    Safeguards to prevent migration of nonproduction keys and certs to production
6.    Readiness for certificate authority (CA) compromise
7.    Effectiveness of EKCM controls (Process capability assessment)


1 SSL and SSH policies in place and annually reviewed

   • Certificate/key attributes thresholds defined
       - Minimum key lengths
       - Approved cryptographic algorithms
       - Maximum certificate and private key validity (rotation) periods
   • Identification of approved certificate authorities (CAs)
       - Guidelines for selecting proper CA (e.g. internal versus external)
   • Approved trusted root certificates
   • Certificate management policies; including:
       - Enrollment procedures for new and renewed certificates
       - Registration authority procedures
       - Minimum renewal periods
   • Private key management policies, including:
       - Administrative access to private keys
       - Allowed keystore types
       - Separation of duties
       - Dual control
   • Logging requirements
   • Roles and responsibilities of all stakeholders
   • Revocation checking is enabled and enforced on relying party systems

2    System-generated inventory of keys and certs

   • Network scans are performed periodically
   • Onboard scans are performed periodically
   • Well-defined procedures are in place for the reliable registration of certificates and private key instances that cannot be discovered by network or onboard scanning.
   • All locations for certificates and private keys
   • All owners or contacts are identified
   • All relevant attributes of the certificates are collected as part of the inventory

3    Keys and certs are compliant with policy

4   Private key management processes reviewed

   • Administrators should not have direct access to private keys
   • Private keys that have been directly accessed by administrators are replaced when those administrators are reassigned or leave the organization
   • Strong credentials are being used for access to the keystores where private keys are stored
   • Separation of duties are enforced (controlled via granular access controls)
   • Dual control is enforced (controlled via workflow review and approvals)
   • All management operations are logged to a secure audit log

5    Safeguards to prevent migration of nonproduction keys and certs to production

   • Security on Dev/Test systems is much lower
       - Keys exposed to many more administrators
       - Movement of Dev/Test key to production creates significant security risk
   • Solution: only allow test CAs to be used to non-production systems
       - Test CAs should not be trusted on production systems (i.e. test root certificates are not installed)
       - Ensures that certificates (and private keys) used in Dev/Test do not move into production


6    Readiness for certificate authority (CA) compromise

   • Security and operations of internal & external certificate authorities (CAs) is regularly audited
   • Backup CAs are in place
       - External CAs: Active contractual relationships are maintained with more than one vendor.
       - Internal CAs: Alternate CA be activated but kept offline
   • Preparation and recovery plans for a CA compromise
       - Reliable procedures for rapidly replacing all certificates issued from each CA currently in use
       - Reliable procedures for rapidly removing trusted root certificates from all applicable trust stores in case of a root CA compromise.
       - Technologies and processes for tracking and monitoring the progress of replacement operations
       - Roles and responsibilities during a CA compromise response

7    Effectiveness of EKCM controls (Process capability assessment)
Perform a sanity check using something like Cobit….

Up to Top




Continue learning with the next suggested topic:

SANS 20 CSC 17




Main Navigation

}
get-started-overlay close-overlay cross icon
get-started-overlay close-overlay cross icon
Venafi Risk assessment Form Image

Sign up for Venafi Cloud


Venafi Cloud manages and protects certificates



* Please fill in this field Please enter valid email address
* Please fill in this field Password must be
At least 8 characters long
At least one digit
At last one lowercase letter
At least one uppercase letter
At least one special character
(@%+^!#$?:,(){}[]~`-_)
* Please fill in this field
* Please fill in this field
* Please fill in this field
* Please fill in this field Please enter valid phone number
*

End User License Agreement needs to be viewed and accepted



Already have an account? Login Here

×
get-started-overlay close-overlay cross icon

How can we help you?

Thank you!

Venafi will reach out to you within 24 hours. If you need an immediate answer please use our chat to get a live person.

In the meantime, please explore more of our solutions

Explore Solutions

learn more

Email Us a Question

learn more

Chat With Us

learn more
Chat