by John Worrall
Richard Stiennon of IT Harvest has an interesting post on digital certificates and the pathway they provide for many of today’s cyber criminals. This is very analogous to something we’ve discussed frequently – the dangers of the “privileged pathway.” 
In his post titled, “Should We Abandon Digital Certificates, Or Learn to Use Them Effectively?” Richard examines digital certificates and calls out that they are “the basis of the most carefully thought out security paradigm of today,” and yet they are “the most highly sought after, and effectively targeted, digital assets of the day.” The premise is that certificates were the basis for the “perfect security solution that relied on trust models,” but the reality is that these certificates were deployed with flawed trust models. As a result – we’ve created our own worst vulnerabilities – attackers know it and are increasingly targeting them to breach the enterprise perimeter.
Richard Stiennon of IT Harvest
Digital certificates are one form of authentication relied on to provide access to admin accounts, critical systems and the core elements of an organization’s security infrastructure. In a subsequent post and interview with Cyber-Ark CEO Udi Mokady, “Grasping The Problem With Privileged Accounts,” Richard examines how privileged accounts are being targeted in nearly 100 percent of all APTs. Attackers steal privileged credentials and subsequently gain unfettered access to critical data, network devices and more. But too often the security model that exists around these powerful accounts has been built on trust models that, well, can’t be trusted, and that is not a good basis for security.
