A Public Key Infrastructure is the foundation for many security functions within applications, Windows platforms and other operating systems. Of particular note are file and e-mail encryption, secure networking with IPSec, and remote VPN connections.

Encryption is a very effective way of protecting data, both on a media or in transmission. Although it will not protect the existence of your data such as, for instance, a backup would, if implemented appropriately it will serve as non-repudiation as well. However, it is a double edged sword; failure to implement solid administration practices and procedures may result in unrecoverable data.

Unfortunately, while the principle of PKI is simple, the implementation can be complicated. The issue is the administration of the key pairs. Among other functions, a mechanism must be in place to generate key pairs, issue them to authenticated clients, revoke them when needed, and still provide secure recovery mechanisms.

However, Microsoft have done their homework. There is an integrated PKI function available in almost all versions of Windows. These services are based on cryptographic functions (like administration) available in the later server versions of Windows.

But, like most things, nothing is for nothing. The degree of inherent functionality depends on the version of Windows and the level of integration between the relevant systems.

C3SC will plan and implement a PKI, based on Windows services, which can be without the need for third party products. We will create SOP’s for the generation, maintenance, and revocation of certificates. We will install and configure both server and client components. We will train your staff in the use of encryption (for file and e-mail encryption). We will automate the certificate generation.

SSL/TLS

Secure Socket Layer and Transport Layer Security are similar protocols, however, the implementation is slightly different. Both SSL and TLS are built on the foundation of your Public Key Infrastructure but TLS is usually implemented with hardware such as smart-cards.

Although both IPSec and SSL use digital certificates generated by the PKI, IPSec services are performed by the operating system and SSL by the application. Knowing this distinction and understanding the implications will allow C3SC to help you make the right choice for your needs.

Specifically, we will:

See also..