Public Key Infrastructure (PKI) and Digital Certificates
Explore PKI concepts, certificate lifecycle management, trust models, and audit procedures essential for CISA exam preparation.
PKI Overview
Public Key Infrastructure (PKI) is a framework of policies, procedures, and technologies that manages digital certificates and public-key encryption. For CISA candidates, understanding PKI is critical because it underpins many security services including authentication, encryption, and digital signatures. Auditors must evaluate whether PKI implementations are properly managed, secured, and aligned with organizational requirements.
PKI enables trust in electronic communications by binding public keys to verified identities through digital certificates issued by trusted Certificate Authorities (CAs). This trust framework is essential for secure web communications, email encryption, code signing, and document authentication.
PKI Components
Certificate Authority (CA)
The CA is the trusted entity that issues, manages, and revokes digital certificates. PKI hierarchies typically include:
- Root CA: The top-level authority in the trust hierarchy. Its private key must be protected with the highest level of security, and root CAs are typically kept offline
- Subordinate (Intermediate) CAs: CAs that receive their authority from the root CA and issue certificates to end entities. Limiting the root CA's exposure by using subordinate CAs reduces risk
- Registration Authority (RA): An entity that verifies the identity of certificate requestors before the CA issues certificates
Digital Certificates
A digital certificate binds a public key to an identity and includes information such as the subject's name, the public key, the issuing CA, validity dates, serial number, and the CA's digital signature. The most common certificate standard is X.509, which defines the certificate format used in TLS/SSL, S/MIME, and other applications.
Certificate Lifecycle Management
Proper certificate lifecycle management is essential for maintaining PKI security:
- Enrollment and issuance: Verifying the requestor's identity and generating the certificate
- Distribution: Delivering certificates to end entities through secure channels
- Renewal: Replacing certificates before they expire to maintain continuity
- Revocation: Invalidating certificates that are compromised, no longer needed, or contain inaccurate information
- Expiration: Certificates that are not renewed become invalid after their validity period ends
Certificate Revocation
Two primary mechanisms handle certificate revocation:
- Certificate Revocation Lists (CRLs): Periodically published lists of revoked certificate serial numbers. CRLs can grow large and may have update delays
- Online Certificate Status Protocol (OCSP): A real-time protocol that allows applications to query the revocation status of a specific certificate. More efficient than CRLs but requires the OCSP responder to be available
Trust Models
PKI trust can be established through different models: hierarchical (single root CA with subordinate CAs), bridge (connecting multiple independent PKI hierarchies), and web of trust (peer-based trust used in PGP). Each model has implications for scalability, management complexity, and trust relationships that auditors should understand.
Audit Considerations
IS auditors evaluating PKI should assess the physical and logical security of CA systems (particularly the root CA), review certificate policies and practice statements, verify that certificate lifecycle processes are documented and followed, test revocation mechanisms to ensure they function correctly, evaluate key protection measures (hardware security modules for CA keys), and review certificate inventory management. Auditors should also assess whether expired or revoked certificates are detected and remediated promptly.