More
The importance of encryption key management

The importance of encryption key management

20-01-2014 10:16:22
Encryption key management for SSL is the process of successfully securing and managing the private key. The private key is the tool that is used to decrypt the information that is received from anyone who has access to the public key. For example if an end-user purchases an item from amazon.com their browser would encrypt the personal information (credit card, address etc.) using the Amazon’s public key, and once that information is received by the Amazon server it would be decrypted by their private key. Because of the unique feature of the private key essentially the most important aspect of SSL and therefore should be securely stored and managed. Below I have discussed a few ways to success store and manage a private key.
 
First there are generally two places that a hacker would be able to access the private key, on the server that is using the certificate or any other place that the private key file is saved. It is important to obviously create a very strong username and password for the server but to also limit the amount of employees that can log-in/ the employees that can log-in should also have unique access and passwords. Second make sure that you enable a CAPTCHA and/or Time-Out feature to limit a brute-force attack. Finally for companies that have hired third parties to manage and run their sites you should always check to make sure that they have the appropriate accreditations (ISO).
 
After you have secured your server make sure that the back-up private key is also securely stored. Do not store the back up on the same server that is using the private key because occasionally servers have been known to crash. I would also recommend not storing the back-up on a cloud (personal reasons). I would recommend password protecting (encrypting) the file and storing it either on your VPN, an encrypted flash drive, or other place that can only be accessed by your company.
 
For more information about SSL Certificate’s please visit our site www.sslguru.com. We also offer free SSL tools to help correctly manage your certificates and the largest SSL store with over 100 different products. For a free consultation give us a call at (626)377-9979 or email us at USA@sslguru.com
 
Source: SSLGuru.com

Recent Posts

European Cyber Security Month 2018
27-09-2018 10:46:21

The European Union Agency for Network and Information Security (ENISA), which is the center of knowledge about cyber security in Europe, organizes as every year in October the European Cyber Security Month. The campaign is starting in a few days. What is its purpose and how can you participate in it?

European Cyber Security Month 2018
GDPR and SSL certificate. Is encryption necessary for compliance with the GDPR?
18-05-2018 15:47:40

General Data Protection Regulation (GDPR) is a 99-article regulation meant to protect the private data of Europeans in IT systems. Announced in 2016, covers a broad variety of topics and will go into effect as a requirement on May 25, 2018. GDPR applies to any company doing business in Europe even if it is located elsewhere.

GDPR and SSL certificate. Is encryption necessary for compliance with the GDPR?
Deadlines for replacing Symantec Group certificates
08-12-2017 14:11:50

In November this year we wrote about the need to replace SSL certificates issued by Symantec Group. Find out the dates when you need to re-issue your certificates.

Deadlines for replacing Symantec Group certificates
more posts