How Insecure Are Your Websites? The Enigma of Digital Certificates (PKI)

Find out more on our website: https://bit.ly/3q2Vbck Public Key Infrastructure (PKI) was globally accepted in the mid 1990's. PKI can be thought of the Authentication, Encryption and Decryption of all digital devices and all data. Think modern day Enigma or Lorenz encryption machines as used in the Second World War that Alan Turing and William Tutte cracked the codes on and you're thinking on the right lines. PKI is made up of Digital Certificates and Encrypted Keys. It is used to identify and encrypt billions upon billions of messages daily in the totally reliant, digital world of communication. Digital certificates in essence take Plain Text data, just like this sentence, and encrypt it into Ciphertext. Once it is received, the recipients PKI, (if trusted) deciphers the text back into plaintext. This exchange of data is seamless. However, if either part is insecure, a Man in the Middle attack (MiTM) can easily be achieved and result in plain text exfiltration. Ransomware has become so popular because organisations have unfortunately a lack of PKI controls and their data can be accessed, at rest (on a server) or in flight (being sent to or from a server) and remain in plain text throughout. Criminals can capture or exfiltrate that data and then hold it to ransom. This situation then quickly, and unequivocally falls foul of all Privacy laws including UKDPA and GDPR. Certificate Authorities (CA's) issue digital certificates in their billions and certificates typically last for 12 months. Many CA's have become household names such as Digicert, GoDaddy and Let's Encrypt. Certificates, have access, and privileges and due to their sheer numerical scale, few, if any companies know what digital certificates make up their PKI or Network. It is why the world's first digital cyberattack (cyber warfare) used digital certificates and weaponised them to create Stuxnet by planting malicious code into them. These weaponised (Microsoft) digital certificates were readily accepted by the Iranian Nuclear power facility in Natanz and used. After 13 days they triggered the malicious code. This resulted in centrifuge disruption resulting in mass destruction through harmonic rupturing. Stuxnet, and more latterly, SolarWinds' cyberattack in December last year, the worlds largest ever cyberattack on thousands of consequential hacks including the US Government, both used the lack of PKI management to disguise and Trojanized their attacks. Speaker: Andy Jenkinson is a senior and seasoned innovative Executive with over 30 years' experience as a hands-on lateral thinking CEO, coach, and leader. A 'big deal' business accelerator, and inspirational, lateral thinker, Andy has crafted, created, and been responsible for delivering 100’s £millions of projects within the Cyber, Technical, Risk and Compliance markets for some of the world's largest, leading organisations. Andy has a demonstrable track record of large-scale technical delivery and management within many sectors including, Professional, Managed, and Financial Services. More latterly Andy was one of the first, and very few people to discover the plethora of insecure SolarWinds domains post their massive cyberattack last year. It has since been proven that Andy’s version of the attack (and many others) of an insecure subdomain being hijacked and a nefarious website being stood up, has now become common knowledge, and widely accepted as being the initial access and root cause of the initial infiltration (Sunburst). Andy’s research and paper was presented to the United States Senate Intelligence Committee overseeing the SolarWinds breach earlier this year.