I’ve often noticed that it can be difficult to find information in one place around PKI solutions and what makes them secure.

That’s why I’ve decided to create a PKI resource myself! This ongoing series will outline the elements that make up a secure PKI. So continuing on from last week’s blog, I’m discussing access control!

Access Control

As with every application and infrastructure in an organisation, access to it should be limited to those who actually need access to it, and with the minimum access required to perform the role that they are assigned. This is not a new concept and commonly known as the principle of least privilege; it’s certainly very relevant to PKI infrastructures within organisations as they provide a critical service and protect the organisation’s sensitive data.

As per Microsoft documentation, the roles within a PKI management team deemed as trusted are as follows:

These all fall broadly into four areas:

It goes without saying, these levels of access should be closely monitored and managed through use of Active Directory Groups, restricted and separate administrative accounts for day-to-day usage and separation of roles specifically around auditing roles and through delegated administration. Additionally, local administrative access to the servers should be restricted as this could lead to unwanted access to the PKI infrastructure for non-authorised role holders.

Further information can be found on the extensive Microsoft Documentation libraries here.

Rest of the Series

Here’s the series in full – I’ll be updating here each week as each part is released:

  1. Multiple Tiers
  2. RSA vs ECC
  3. Access Control
  4. Physical Access
  5. Backups
  6. Certificate Revocation Lists

If you have any questions on what I’ve discussed here or security in general, feel free to email in on info@poweronplatforms.com and I’ll be happy to answer any queries you have.

AOVPN DPC Webinar with Richard Hicks

Join our next webinar where Head of Identity and Access Leo D’Arcy will be joined by Richard Hicks for an overview of DPC version 3.0 and a Q&A.

Register now

AOVPN DPC Webinar with Richard Hicks

Join our next webinar where Head of Identity and Access Leo D’Arcy will be joined by Richard Hicks for an overview of DPC version 3.0 and a Q&A.

Register now

Leave a Reply