If you have never heard of Public Key Infrastructure (PKI), you almost certainly encounter it every day. Simply stated, PKI protects data on the Internet when it is transmitted by people or public or private entities. You are likely reading this article on a computer, smart phone, or some other device via a web browser that is protected with PKI (most websites are secured with PKI as well).
It is not difficult for someone outside of the information technology field to understand how important PKI is. Without it, data—whether it be personal identifiable information (PII) or classified government information—could more easily be stolen and used for malicious purposes. To be sure, PKI is not 100% foolproof, but it is the best way to safeguard transmitted data.
What Exactly is PKI and Why is it Essential?
To begin with, it is critical to understand that PKI is not one thing. It is more like a system of various components—software, hardware, processes, policies, and procedures—that work together to secure data using encryption. You can think of it as a framework (i.e. infrastructure) to ensure that data, when sent over the Internet, is protected. PKI is used when passwords alone are insufficient to authenticate the data being sent and the person or entity sending that information.
Specifically, the main function of PKI is to create, manage, store, distribute, verify, and revoke encrypted public and private keys, which are made up of long strings of characters (randomly generated numbers). They are created together and are mathematically related, which is what allows them to be used to read encrypted messages. The process of creating public and private keys is called asymmetric encryption because it creates two keys.
Public and private keys are, in a way, sophisticated passwords. They change messages into a format that only they can read. In simple terms, they work like this: the public key converts a message into an encrypted format, then the corresponding private key decrypts the message. No other public or private keys can read the message.
Another crucial aspect of keys is that they are bound to a specific person or entity. Binding is done through a digital certificate, which certifies the identity of a person or entity. In effect, a digital certificate does the same thing a passport does but in digital form. It is issued by a third-party organization called a Certificate Authority (CA) and cannot be forged. In order to obtain a digital certificate, a person or entity must provide proof of identity to the CA.
In sum, PKI facilitates secure web-based communication, which is vital for a range of activities— from sending private emails to global commerce. It gives individuals and organizations those extra layers of protection they need to reduce the risk of information being stolen.
Effectively Managing PKI is Critical for Continued Security
Fortunately, implementing a PKI system is not very difficult and has become the standard policy for businesses of any size. However, a PKI is only fully effective if it is regularly maintained and updated. This pertains specifically to the security of public and private keys and digital certificates, which have lifecycles and don’t last forever. A lifecycle consists of creation, storage, distribution, usage, revocation, renewal, archiving, and deletion. If there is any lapse of oversight in any of these stages, the PKI becomes weaker and vulnerable to external threats. As such, poor PKI management is what leads to security breaches rather than built-in flaws in the system.
PKI can be Leveraged for the Internet of Things (IoT) Sector
Every day, more and more devices that aren’t computers, tablets, or smart phones are becoming connected to the Internet and to each other. These can be anything, such as refrigerators, vehicles, thermostats, door locks, and even your pet’s feeder. Usually, these devices can be controlled from your smart phone using a corresponding app. This means you don’t need to be at home or where the connected device is to control it. For example, you can raise or lower the temperature of your home’s thermostat by simply using the app. It is also possible to watch a person, like a delivery driver, who rings the doorbell on your phone.
However, while the ability to control devices from afar is very convenient, it comes at a high cost. The fact that so many things are connected to the Internet increases opportunities for intruders to steal information. A stark example of this is what happened in 2016 with the “Mirai botnet” attack in October 2016, which didn’t directly target websites but IoT devices including DVR players and surveillance cameras that were not sufficiently protected with authenticated certificates. This attack was especially dangerous because so many IoT devices exist all over the world (it is estimated that there will be 50-200 billion of them by 2020).
This is where PKI comes in and it is essential for any businesses big or small. As described above, PKI provides a strong level of security because digital certificates and keys are encrypted, meaning that individuals, data, and entities can be authenticated. This is where the real value of PKI lies. And as IoT continues to expand, relationships with customers will only continue to grow. Having a secure framework in place protects information which, in turn, builds trust with customers.
PKI is a Key ingredient in the Future of Cyber Security
No PKI system is perfect; it is only strong as its weakest link. Without continued maintenance and oversight, any part, could become vulnerable. For example, some experts question whether CAs can be really trusted.
Despite these concerns, PKI is one of the best ways to protect information. It is a tried-and-true method used by virtually everyone, from small businesses to major corporations. In order to keep data confidential in the growing IoT sector, implementing a robust PKI framework will protect the expanding multitude of connected devices. Without such a program in place, data breaches will likely occur and customer trust will decrease as a result.
