There is an old adage from the British Army known as the ‘seven Ps', and it is frequently used in project planning or when training for life-or-death situations.
‘Proper planning and preparation prevents piss poor performance'. My apologies if I have offended anybody, but every organisation needs to ask itself if it has planned and is prepared for increasingly likely attacks.
As anyone who has been following the news for the last few months will realise, the SSL certificate has now become a key target in the cyber attack arsenal. Flame, Stuxnet and Duqu are the high-tech weapons, and are likely only the tip of the iceberg when it comes to what is lurking beneath.
Each of these pieces of malware have been signed by a digital certificate owned, or appearing to be owned, by reputable companies and issued by trusted authorities, or are appearing to be.
In spite of all the cries that SSL is not safe and that there are problems with the trust model, the fact of the matter is that SSL is probably the best we have right now to protect ourselves. No one claims it is perfect, but I haven't yet seen a better and more secure alternative.
Passwords are certainly not the way to go – they are being hacked and some will argue that one-time password (OTP) token-based solutions do the job, but it's not so long ago that RSA was replacing millions of them. The biggest problem with SSL certificates is that most organisations have applied no proper planning and preparation for the use of certificates, and as a result are vulnerable to attack.
Contrary to popular opinion, Microsoft did not invent Excel to be a certificate management or policy enforcement system, although given the extensive use of Excel among PKI departments, they could probably re-certify it and charge a fee! But then in most companies this is the level of sophistication that exists. So here are some guidelines that might be helpful: