PKI, The Key to Securing Sensitive
Electronic Communications
Madison College
April 24, 2014
Nicholas Davis,
CISSP, CISA, N...
Agenda
• Introduction
• We will watch movies
• We will find an error in the textbook
• We will learn
• We will chat
• We w...
Overview
Why is electronic privacy such a hot
topic these days?
What is a digital certificate?
What is PKI?
Why are these ...
Whay is Electronic Privacy
Such a Hot Topic Today?
• Evolution of the
Internet, commerce, banking, healt
hcare
• Dependenc...
The Topic is More Interesting
When It Affects You!
Intercepting Your Electronic
Communications
Discussion Topic One
• Do you think the threat of Email
eavesdropping is real?
• What about the government’s argument
abou...
What is a Digital Certificate?
Digital Certificates Continued
Digital Certificate
Electronic Passport
Good for authentication
Good non-repudiation
Proof ...
What is in a Certificate?
Public and Private Keys
The digital certificate has two parts, a
PUBLIC key and a PRIVATE key
The Public Key is distribute...
Public Key Cryptography
Getting Someone’s Public Key
The Public Key must be shared to be
Useful
It can be included as part of your
Email signature...
Who Could This Public Key
Possibly Belong To?
What is PKI?
• PKI is an acronym for Public Key
Infrastructure
• It is the system which manages and
controls the lifecycle...
What Is In a PKI?
• Credentialing of individuals
• Generating certificates
• Distributing certificates
• Keeping copies of...
Credentialing
• Non technical, but the most
important part of a PKI!
• A certificate is only as trustworthy as
the underly...
Certificate Generation and Storage
• How do you know who you are
dealing with in the generation
process?
• Where you keep ...
Distributing Certificates
• Can be done
remotely – benefits
and drawbacks
• Can be done face
to face – benefits
and drawba...
Keeping Copies – Key Escrow
• Benefit –
Available in case
of emergency
• Drawback – Can
be stolen
• Compromise is
the best...
Certificate Renewal
• Just like your passport, digital certificates
expire
• This is for the safety of the organization
an...
Expiration
• A rare moment for me…I get to point out
and error in the textbook! (Page 418)
• A message signed with an expi...
Revocation
• Just like Stefan Wahe’s dirving
license, it can be revoked prior to
expiration
• CRL – Certificate Revocation...
Recovery
• No escrow = no luck
• But with escrow it must be
easy, right? !!NOT!!
• Proving identity
• Getting copy from es...
Trusted Root Authorities
• A certificate issuer
recognized by all
computers around
the globe
• Root certificates
are store...
It Is All About Trust
Using Certificates to Secure Email
• Best use for certificates, in my
opinion
• Digital certificate provides proof that
th...
Secure Email is Called
S/MIME
• S/MIME = Secure
Multipurpose Mail
Extensions
• S/MIME is the
industry standard,
not a poin...
Digital Signing of Email
• Proves that the email came from you
• Invalidates plausible denial
• Proves through a checksum ...
Digital Signatures Do Not Prove When
a Message or Document Was Signed
You need a
neutral third party
time stamping
service...
Send Me a Signed
Email, Please, I Need Your Public
Key
Using a Digital Signature for Email
Signing
Provides proof that the
email came from the
purported sender…Is
this email rea...
A Digital Signature Can Be Invalid For
Many Reasons
Why Is Authenticating the Sender So
Important?
What if This Happens at Madison
College?
Could cause harm in
a critical situation
Case Scenario
Multiple hoax emails
sent ...
Digital Signing Summary
• Provides proof of the author
• Testifies to message integrity
• Valuable for both individual or
...
What Encryption Does
Encrypting data with a
digital certificate
Secures it end to end.
• While in transit
• Across the net...
Encryption Protects the Data At Rest
and In Transit
Physical theft from office
Physical theft from airport
Virtual theft o...
Why Encryption is Important
• Keeps private information private
• HIPAA, FERPA, SOX, GLB compliance
• Proprietary research...
What does it actually look like in practice?
-Sending-
What does it actually look like in
practice (unlocking my private key)
-receiving-
What does it actually look like in practice?
-receiving- (decrypted)
Digitally signed and verified;
Encrypted
What does it look like in practice?
-receiving- (intercepted)
Intercepting the Data in Transit
• How might encrypted email be a
security threat to your organization?
Digital Certificates For Machines Too
• SSL – Secure
Socket Layer
• Protection of data
in transit
• Protection of data
at ...
Benefits of Using Digital
Certificates
Provide global assurance of your identity,
both internally and externally to the or...
The Telephone Analogy
When the
telephone was
invented, it was
hard to sell.
It needed to
reach critical
mass and then
ever...
That All Sounds Great in Theory,
But Do I Really Need It?
• The world seems
to get along just
fine without digital
certifi...
We Have Internal Threats Too
@ UW-Madison!
How Do Users Feel About the
Technology?
• Ease of use
• Challenges
• Changes in how they do their daily
work
• Benefits
• ...
It Really Is Up To You!
• Digital certificates / PKI is not hard to
implement
• It provides end to end security of
sensiti...
Signatures - Evidence
• What is a signature?
• A signature is not part of the substance of a
transaction, but rather, it r...
Let’s Talk About Signatures
• Traditional ink and paper
• Electronic Signature vs Digital
Signature
Signatures – The Three Part Process
• Ceremony, Approval and Commitment
Signatures – The Three
Part Process
• Ceremony:
• The act of signing a document calls to the
signer's attention the signif...
Signatures – The Three
Part Process
• Approval:
• In certain contexts defined by law or
custom, a signature expresses the
...
Signatures – The Three
Part Process
• Commitment:
• A signature on a written document
often imparts a sense of clarity and...
Signatures
• Traditional signatures put the cart before
the horse!
• How can you be certain that a mortgage
application wi...
Signatures
• Trust – When the going gets tough,
scoundrels can emerge, to challenge the
signature on a document
• Verifica...
Signature
• Before a signature can be trusted, we
must have proof that the signature does
truly belong to the signer
• Thi...
Signatures – Credentialing
Process
• Credentialing – An initial method of
attestation to the truth of certain stated
facts...
Signatures – Authentication
Process
• Authentication – The process of verifying
that a person is in fact who they claim to...
Signatures – Authorization
Process
• Authorization -- The granting of power or
authority to someone, to do something
speci...
Signatures -- Trust
• In order for a signature to be relied upon
and trusted for authorization of a
transaction, the indiv...
Signatures -- Trust
• A written signature, provided without
a solid credentialing and
authentication process, can make an
...
Digital Signatures vs.
Written Signatures
• A digital signature provides proof of:
• Verified identity of the signer
• Doc...
Digital Signatures – A Note About Identity Theft
• As the Internet and E-Commerce
continue to evolve and grow, it is
impor...
Digital Signatures
• Written signatures may be
acceptable in person, but are
impractical and risky when used in
an online ...
Digital Signatures vs Electronic Signatures
• “Electronic signature” and “Digital
signature” are not synonymous.
• An elec...
Digital Signatures vs
Electronic Signatures
• A digital signature is a form of an
electronic signature, but an
electronic ...
!!!Stop Sleeping!!!
Chapter 12 – Most Important
Stuff, in the next six slides!
Types of Certificates
• Certificate Authority (CA), issues
and signs other types of certs,
NEVER used for other functions
...
Types of Certificates
• Object Signing Certificates: Used by
an entity to sign software code, to
prove origin and integrit...
PKI Components
• Certificate Authority (CA): Issues
and verifies certificates
• Registration Authority (RA): Verifies
iden...
PKI Components
• Certificate Management System:
CA, RA, CRLs, etc, all together, to
keep track of certificates and their
s...
PKI Management Tasks
• Identity verification
• Certificate issuance
• Certificate validity checking
• Certificate renewal
...
Transport Protocols
• SSL: Developed by Netscape, 1996
• TLS: Variation of SSL (RFC 2246)
• HTTPS: Web server, Port 443, b...
How Can I Help You?
ndavis1@wisc.edu
Tel. 608-347-2486
Upcoming SlideShare
Loading in...5
×

Pki the key to securing sensitive communications

409
-1

Published on

PKI overview presentation for Madison College students, in their IT Security course.

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
409
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
39
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Pki the key to securing sensitive communications

  1. 1. PKI, The Key to Securing Sensitive Electronic Communications Madison College April 24, 2014 Nicholas Davis, CISSP, CISA, Nice Person
  2. 2. Agenda • Introduction • We will watch movies • We will find an error in the textbook • We will learn • We will chat • We will have fun
  3. 3. Overview Why is electronic privacy such a hot topic these days? What is a digital certificate? What is PKI? Why are these technologies important? Trusted Root Authorities Using digital certificates for email encryption Key Escrow, the double edged sword Integrating digital certificates into email for Security How is PKI related to SSL? Using certificates for code signing of software Real world issues with PKI Chapter 12 top points!!! Discussion
  4. 4. Whay is Electronic Privacy Such a Hot Topic Today? • Evolution of the Internet, commerce, banking, healt hcare • Dependence on Email and other trusted electronic communications • Government regulations, SOX, HIPAA, GLB, P CI, FERPA • Public Image • Business warehousing
  5. 5. The Topic is More Interesting When It Affects You!
  6. 6. Intercepting Your Electronic Communications
  7. 7. Discussion Topic One • Do you think the threat of Email eavesdropping is real? • What about the government’s argument about Email being like a “postcard?” • Should Target be allowed to look at Walmart emails on a public network? • Are you angry now, or just afraid? • Who has the responsibility in this situation?
  8. 8. What is a Digital Certificate?
  9. 9. Digital Certificates Continued Digital Certificate Electronic Passport Good for authentication Good non-repudiation Proof of authorship Proof of non-altered content Encryption! Better than username - password
  10. 10. What is in a Certificate?
  11. 11. Public and Private Keys The digital certificate has two parts, a PUBLIC key and a PRIVATE key The Public Key is distributed to everyone The Private Key is held very closely And NEVER shared Public Key is used for encryption and verification of a digital signature Private Key is used for Digital signing and decryption
  12. 12. Public Key Cryptography
  13. 13. Getting Someone’s Public Key The Public Key must be shared to be Useful It can be included as part of your Email signature It can be looked up in an LDAP Directory Can you think of the advantages and disadvantages of each method?
  14. 14. Who Could This Public Key Possibly Belong To?
  15. 15. What is PKI? • PKI is an acronym for Public Key Infrastructure • It is the system which manages and controls the lifecycle of digital certificates • The PKI has many features
  16. 16. What Is In a PKI? • Credentialing of individuals • Generating certificates • Distributing certificates • Keeping copies of certificates • Reissuing certificates • Revoking certificates • Renews certificates • Providing proof of validity or revocation
  17. 17. Credentialing • Non technical, but the most important part of a PKI! • A certificate is only as trustworthy as the underlying credentialing and management system • Certificate Policies and Certificate Practices Statement
  18. 18. Certificate Generation and Storage • How do you know who you are dealing with in the generation process? • Where you keep the certificate is important
  19. 19. Distributing Certificates • Can be done remotely – benefits and drawbacks • Can be done face to face – benefits and drawbacks
  20. 20. Keeping Copies – Key Escrow • Benefit – Available in case of emergency • Drawback – Can be stolen • Compromise is the best! • Use Audit Trails, separatio n of duties and good accounting controls for key escrow
  21. 21. Certificate Renewal • Just like your passport, digital certificates expire • This is for the safety of the organization and those who do business with it • Short lifetime – more assurance of validity but a pain to renew • Long lifetime – less assurance of validity, but easier to manage • Can be renewed with same keypair or new keypair depending on escrow situation
  22. 22. Expiration • A rare moment for me…I get to point out and error in the textbook! (Page 418) • A message signed with an expired private key will show as invalid to the recipient • However, a private key can ALWAYS be used to decrypt a message, even an expired private key. • Nobody is perfect, forgive the textbook author!
  23. 23. Revocation • Just like Stefan Wahe’s dirving license, it can be revoked prior to expiration • CRL – Certificate Revocation List • OCSP – Online Certificate Status Protocol • Both cam be real time, but CRL might be batched instead • In practice, both are rarely used
  24. 24. Recovery • No escrow = no luck • But with escrow it must be easy, right? !!NOT!! • Proving identity • Getting copy from escrow • Secure delivery to recipient • Complex, tempting to cut corners, but resist temptation! • The book’s idea is even more complex!
  25. 25. Trusted Root Authorities • A certificate issuer recognized by all computers around the globe • Root certificates are stored in the computer’s central certificate store • Requires a stringent audit and a lot of money!
  26. 26. It Is All About Trust
  27. 27. Using Certificates to Secure Email • Best use for certificates, in my opinion • Digital certificate provides proof that the email did indeed come from the purported sender • Public key enables encryption and ensures that the message can only be read by the intended recipient
  28. 28. Secure Email is Called S/MIME • S/MIME = Secure Multipurpose Mail Extensions • S/MIME is the industry standard, not a point solution, unique to a specific vendor
  29. 29. Digital Signing of Email • Proves that the email came from you • Invalidates plausible denial • Proves through a checksum that the contents of the email were not altered while in transit • Provides a mechanism to distribute your public key
  30. 30. Digital Signatures Do Not Prove When a Message or Document Was Signed You need a neutral third party time stamping service, similar to how hostages often have their pictures taken in front of a newspaper to prove they are still alive!
  31. 31. Send Me a Signed Email, Please, I Need Your Public Key
  32. 32. Using a Digital Signature for Email Signing Provides proof that the email came from the purported sender…Is this email really from Vice President Cheney? Provides proof that the contents of the email have not been altered from the original form…Should we really invade Mexico?
  33. 33. A Digital Signature Can Be Invalid For Many Reasons
  34. 34. Why Is Authenticating the Sender So Important?
  35. 35. What if This Happens at Madison College? Could cause harm in a critical situation Case Scenario Multiple hoax emails sent with Chancellor’s name and email. When real crisis arrives, people might not believe the warning. It is all about trust!
  36. 36. Digital Signing Summary • Provides proof of the author • Testifies to message integrity • Valuable for both individual or mass email • Supported by most email clients….Remember the 80-20 rule..Perfect in the enemy of good!
  37. 37. What Encryption Does Encrypting data with a digital certificate Secures it end to end. • While in transit • Across the network • While sitting on email servers • While in storage • On your desktop computer • On your laptop computer • On a server
  38. 38. Encryption Protects the Data At Rest and In Transit Physical theft from office Physical theft from airport Virtual theft over the network
  39. 39. Why Encryption is Important • Keeps private information private • HIPAA, FERPA, SOX, GLB compliance • Proprietary research • Human Resource issues • Legal Issues • PR Issues • Industrial Espionage • Over-intrusive Government • You never know who is listening and watching!
  40. 40. What does it actually look like in practice? -Sending-
  41. 41. What does it actually look like in practice (unlocking my private key) -receiving-
  42. 42. What does it actually look like in practice? -receiving- (decrypted)
  43. 43. Digitally signed and verified; Encrypted
  44. 44. What does it look like in practice? -receiving- (intercepted)
  45. 45. Intercepting the Data in Transit • How might encrypted email be a security threat to your organization?
  46. 46. Digital Certificates For Machines Too • SSL – Secure Socket Layer • Protection of data in transit • Protection of data at rest • Where is the greater threat? • Certs can protect both, but usually just in transit, and not at rest.
  47. 47. Benefits of Using Digital Certificates Provide global assurance of your identity, both internally and externally to the organization Provide assurance of message authenticity and data integrity Keeps private information private, end to end, while in transit and storage You don’t need to have a digital certificate To verify someone else’s digital signature Can be used for individual or generic mail accounts.
  48. 48. The Telephone Analogy When the telephone was invented, it was hard to sell. It needed to reach critical mass and then everyone wanted one.
  49. 49. That All Sounds Great in Theory, But Do I Really Need It? • The world seems to get along just fine without digital certificates… • Oh, really? • Let’s talk about some recent stories
  50. 50. We Have Internal Threats Too @ UW-Madison!
  51. 51. How Do Users Feel About the Technology? • Ease of use • Challenges • Changes in how they do their daily work • Benefits • Drawbacks
  52. 52. It Really Is Up To You! • Digital certificates / PKI is not hard to implement • It provides end to end security of sensitive communications • It is comprehensive, not a mix of point solutions • You are the leaders of tomorrow, make your choices count by pushing for secure electronic communications!
  53. 53. Signatures - Evidence • What is a signature? • A signature is not part of the substance of a transaction, but rather, it represents an understanding, acceptance or indication of agreement • Evidence: A signature authenticates a person by linking the signer with the signed document. When the signer makes a mark in a distinctive manner, the writing becomes attributable to the signer. • Example: Credit card receipt
  54. 54. Let’s Talk About Signatures • Traditional ink and paper • Electronic Signature vs Digital Signature
  55. 55. Signatures – The Three Part Process • Ceremony, Approval and Commitment
  56. 56. Signatures – The Three Part Process • Ceremony: • The act of signing a document calls to the signer's attention the significance of the signer's act, and thereby helps prevent reckless or careless commitments
  57. 57. Signatures – The Three Part Process • Approval: • In certain contexts defined by law or custom, a signature expresses the signer's approval or authorization of the writing, or the signer's intention that it have legal effect
  58. 58. Signatures – The Three Part Process • Commitment: • A signature on a written document often imparts a sense of clarity and finality to the transaction
  59. 59. Signatures • Traditional signatures put the cart before the horse! • How can you be certain that a mortgage application with Nicholas Davis’s signature was indeed signed by Nicholas Davis? • As trusting people, we generally accept a written signature at face value
  60. 60. Signatures • Trust – When the going gets tough, scoundrels can emerge, to challenge the signature on a document • Verification against other documents – Assumes that you have access to other signed documents and assumes that signatures on those documents were not forged
  61. 61. Signature • Before a signature can be trusted, we must have proof that the signature does truly belong to the signer • This is not as easy at it sounds…..
  62. 62. Signatures – Credentialing Process • Credentialing – An initial method of attestation to the truth of certain stated facts, such as identity. • Example: Government photo ID, address verification or proof of your SSN#, are all attestation methods used to credential people
  63. 63. Signatures – Authentication Process • Authentication – The process of verifying that a person is in fact who they claim to be • Example: Showing your driver’s license to the guard at the front desk authenticates me as genuinely being Nicholas Davis
  64. 64. Signatures – Authorization Process • Authorization -- The granting of power or authority to someone, to do something specific • Example: The information system authorizes Nicholas Davis the rights to view certain files
  65. 65. Signatures -- Trust • In order for a signature to be relied upon and trusted for authorization of a transaction, the individual presenting the signature must first be credentialed and then authenticated, prior to allowing them to authorize a transaction • A three step process: Credentialing, Authentication, Authorization • In the world of written signatures, organizations rarely credential or authenticate people
  66. 66. Signatures -- Trust • A written signature, provided without a solid credentialing and authentication process, can make an organization and its customers vulnerable to fraudulent transactions • To further protect the organization and our customers from fraud, we look to information technology and the use of digital signatures…..
  67. 67. Digital Signatures vs. Written Signatures • A digital signature provides proof of: • Verified identity of the signer • Document integrity (The document has not been altered since it was digitally signed) • Non-repudiation (the signer can’t deny signing the document, as it was done with their digital certificate, which only they had access to) • A written signature provides proof of: • Unverified identity of the signer • Which type of signature provides a higher degree of trust?
  68. 68. Digital Signatures – A Note About Identity Theft • As the Internet and E-Commerce continue to evolve and grow, it is important to understand what this change in business environment means • More and more traditional business processes are being converted to online applications • It is harder to impersonate someone in person than it is over the Internet
  69. 69. Digital Signatures • Written signatures may be acceptable in person, but are impractical and risky when used in an online transaction because, we no longer can associate a face with the signature • If our processes are going digital, so must our signatures!
  70. 70. Digital Signatures vs Electronic Signatures • “Electronic signature” and “Digital signature” are not synonymous. • An electronic signature can be a symbol, sound, or process used to sign a document or transaction. • A digital signature, on the other hand, is a secure electronic signature which uses encryption to authenticate the entity who signed the document, encapsulate document contents to protect from unauthorized alteration and provide proof of non-repudiation
  71. 71. Digital Signatures vs Electronic Signatures • A digital signature is a form of an electronic signature, but an electronic signature is not necessarily a digital signature. • Electronic signatures at best provide only questionable proof of identity, and do not provide proof of information/message integrity or non-repudiation
  72. 72. !!!Stop Sleeping!!! Chapter 12 – Most Important Stuff, in the next six slides!
  73. 73. Types of Certificates • Certificate Authority (CA), issues and signs other types of certs, NEVER used for other functions • Server Certificates: Such as SSL, for identification and encryption of data for an entity • User Certificates: Such as P12 or PFX files, for identification and encryption of data of an individual
  74. 74. Types of Certificates • Object Signing Certificates: Used by an entity to sign software code, to prove origin and integrity. • Signature Verification Certificates: Object or user certificate WITHOUT the signing key • DCM = Digital Certificate Manager, stores and organizes all of your certificates
  75. 75. PKI Components • Certificate Authority (CA): Issues and verifies certificates • Registration Authority (RA): Verifies identity and enrolls a requestor, (machine or human) • Revocation Mechanism: CRL or OCSP • Publishing methods: Directories, databases, email, even floppy disk.
  76. 76. PKI Components • Certificate Management System: CA, RA, CRLs, etc, all together, to keep track of certificates and their status, and change status, if necessary. • MOST important: PKI aware applications, such as S/MIME email, or Microsoft Word.
  77. 77. PKI Management Tasks • Identity verification • Certificate issuance • Certificate validity checking • Certificate renewal • Certificate revocation • Certificate escrow • Certificate recovery
  78. 78. Transport Protocols • SSL: Developed by Netscape, 1996 • TLS: Variation of SSL (RFC 2246) • HTTPS: Web server, Port 443, built into MOST browsers • SSH: Secure Shell, TCP Port 22 • SFTP: Secure File Transfer • SCP: Secure File Copy • IPSEC: TCP layer 3 packet encryption RFC 4301-4309
  79. 79. How Can I Help You? ndavis1@wisc.edu Tel. 608-347-2486
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×