IT Harvest’s Richard Stiennon Focuses on the Keys to the Kingdom on

May 29, 2013 John Worrall

by John Worrall

Richard Stiennon of IT Harvest has an interesting post on digital certificates and the pathway they provide for many of today’s cyber criminals. This is very analogous to something we’ve discussed frequently – the dangers of the “privileged pathway.”

In his post titled, “Should We Abandon Digital Certificates, Or Learn to Use Them Effectively?” Richard examines digital certificates and calls out that they are “the basis of the most carefully thought out security paradigm of today,” and yet they are “the most highly sought after, and effectively targeted, digital assets of the day.” The premise is that certificates were the basis for the “perfect security solution that relied on trust models,” but the reality is that these certificates were deployed with flawed trust models. As a result – we’ve created our own worst vulnerabilities – attackers know it and are increasingly targeting them to breach the enterprise perimeter.

Richard Stiennon of IT Harvest

Digital certificates are one form of authentication relied on to provide access to admin accounts, critical systems and the core elements of an organization’s security infrastructure. In a subsequent post and interview with Cyber-Ark CEO Udi Mokady, “Grasping The Problem With Privileged Accounts,” Richard examines how privileged accounts are being targeted in nearly 100 percent of all APTs. Attackers steal privileged credentials and subsequently gain unfettered access to critical data, network devices and more. But too often the security model that exists around these powerful accounts has been built on trust models that, well, can’t be trusted, and that is not a good basis for security.



Previous Article
Shamoon-Proofing Critical Infrastructure Companies
Shamoon-Proofing Critical Infrastructure Companies

by Yariv Lencher The Shamoon virus was designed with one thing in mind – causing mass destruction. It’s a m...

Next Article
Excessive Admins and Privileged Security – Part I
Excessive Admins and Privileged Security – Part I

by John Worrall Roger Grimes of InfoWorld proved once again that he’s one IT security influencer who truly ...