Digital certificates need to regain users' trust
Connecting state and local government leaders
In the face of growing use of stolen and fake certificates to deliver malicious code, NIST and an industry alliance are working to improve what has become an automated, online process.
In the face of the growing use of stolen and fraudulent digital certificates to deliver malicious code, the National Institute of Standards and Technology has developed a set of baseline security controls and practices to support the secure issuance of the certificates.
Publicly trusted certificate authorities (CAs) — third-party organizations that issue certificates that are used to identify their users and digitally sign software — “form the basis for one of the primary mechanisms for providing strong assurance of identity in online transactions,” NIST says in its draft Interagency Report 7924, Reference Certificate Policy.
The report provides a standard model for a certificate policy defining the expectations and requirements to ensure trust between certificate authorities and those who rely on certificates to secure online transactions. The model document can be tailored to meet the specific needs of an agency or other organization.
“The widely placed trust in CAs is at the heart of security mechanisms used to protect business and financial transaction online,” the policy says. “Notably, protocols such as Transport Layer Security (TLS) rely on CAs to identify servers and clients in Web transactions. Governments around the world rely on CAs to identify parties involved in transactions with them.”
Much of the trust structure is automated, with servers and applications such as Web browsers relying on digital certificates without the individual users’ direct involvement.
Trust — and security — can be eroded when certificates are misused, which has been happening increasingly often in the past several years. “Analyses have revealed that these security breaches were often the result of insufficient security controls being in place on the computer systems and networks at these CAs, and sometimes exacerbated by weak record keeping,” NIST said.
It was discovered in 2010 that Stuxnet used compromised certificates to install itself, as did the related Flame malware, and stolen digital certificates have been used recently to deliver malware from a compromised site providing support for Tibetan refugee children and to steal virtual money in global attacks against online gaming companies. The security company Bit9 announced in February that it too had been a victim.
“Due to an operational oversight within Bit9, we failed to install our own product on a handful of computers within our network,” a blog post said. “As a result, a malicious third party was able to illegally gain temporary access to one of our digital code-signing certificates that they then used to illegitimately sign malware.”
Industry members recently formed an alliance to combat the problem. Seven of the largest publicly trusted CAs announced the Certificate Authority Security Council in February, to work with standards organizations and provide research, education and advocacy support for best practices for issuance and use of certificates.
Founding members include Comodo, DigiCert, Entrust, GlobalSign, Go Daddy, Symantec and Trend Micro.
NIST’s draft policy is based on the Federal Public Key Infrastructure Common Policy and addresses the need to ensure trust in a system for issuing digital certificates initially conceived as an offline process but which has evolved into an automated, online environment.
“This change in architecture, along with the changing threat environment faced by online systems, necessitates additional security mechanisms in place at CAs,” the document says.
Comments on the draft policy should be made by June 7 to nistir7924-comments@nist.gov using the comment form available online.