A success story of how we transformed a leading US healthcare organization’s security with our PKI assessment

Company Overview

We just completed one of the most extensive public key infrastructure assessment projects with the leading Minnesota-based healthcare organization, a leader in its field, serves as a home to more than 7000 passionate professionals, dedicated to setting new standards for pharmacies and develop treatments, aspiring to find disease cures. Decades have passed, and this organization became an exemplary name, simplifying complexities and delivering exceptional home-based pharmacy services platform to millions across nations. The bigger it grew, the more challenges came along, especially in its Public Key Infrastructure management.

Challenges

Over the years, their PKI had evolved without a structured approach to implementing Certificate Authorities (CA) and updating certificate revocation lists. This ad-hoc process became less of a security system and more of a patchwork, functional but not scalable.

Manual managing the lifecycle processes, such as issuance, renewal, and revocation of certificates of thousands of certificates was difficult for the organizations, which delayed operations and increased the risk of service outages caused by the expired certificates lingering in the system. It became a classic case of “what got you here won’t get you in the future,” and they realized it was time for a change.

Our security architect put it appropriately, “The organization’s PKI environment had evolved to meet immediate security requirements, but without a compliance-focused strategy or centralized oversight, it left critical gaps that could lead to costly penalties.” These gaps left certificate-related risks untracked.

Additionally, there were no formal policies like Certificate Policy (CP) or Certificate Practice Statement (CPS) documents to guide PKI operations. Root CA and Issuing CA’s private keys were stored locally in software-based solutions lacking strong access controls.

In a hybrid environment, consistency is hard to achieve. With operations across both on-premises and cloud-based platforms, the organization grappled with the challenges of managing constant cryptographic controls and policy enforcement with varying security requirements.

One of the key stakeholders shared, “Every time we thought we had control of the security, a new blind spot would appear.” The lack of visibility and operational challenges, like the absence of a regular backup process for certificate authority databases, exposed them to data loss and certificate discovery never took place due to which wildcard and self-signed certificates were lying in their environment unnoticed increasing the chances of certificate outages.

Without a maintained certificate inventory or proper certificate discovery process, wildcards and self-signed certificates would remain hidden in the environment. Such certificates created blind spots resulted in unauthorized access, lack of accountability, and potential exploitation of unused certificates.

The PKI environment also lacked the agility to adapt quickly to future demands, as it was built with a dependency on a single CA or a rigid CA strategy, which ultimately locked the organization with one vendor, making it difficult to respond to emerging security trends, regulatory changes or updates in cryptographic standards, such as transitioning from TLS 1.2 protocol to TLS 1.3 protocol.

Solution

After thoroughly evaluating various PKI assessment platforms, the organization chose our structured and phased approach as the ideal solution to addressing their pressing challenges, recognizing our proven track record in delivering tailored, efficient, and scalable security and compliance services.

We evaluated the PKI infrastructure’s ability to support integrations with multiple CAs. This flexibility would enable the organization to meet diverse use cases, from internal certificates to external compliance requirements, without being tied to a single vendor.

With the project scope clearly defined, we began by reviewing their existing policies and standards, including data classification, certificate, and key management policies. We gained a clear understanding of their operational challenges and security requirements, which helped us to establish the use cases, including:

• Securing client and server communication
• Enabling least privilege access control principles
• Centralized and automated certificate and key management
• Implementing strong and compliant cryptographic controls and standards

We conducted workshops with identified stakeholders to assess their existing PKI environment. This included providing detailed gap analysis to assess their “as-is” PKI versus “to-be” PKI state.

The analysis identified areas of improvement in certificate lifecycle management process, key management practices, certificate policy, and certificate practice documentation.

This evaluation was conducted using a custom PKI framework, designed in alignment with industry best practices and compliance standards, such as NIST 2.0 and FIPS 140-2/3.

To identify gaps and areas of improvement it served as a reference model to build a strategic remediation roadmap for a future-ready PKI environment.

After conducting the assessment, we built a tailored strategy prioritizing adherence to regulatory standards, such as NIST SP 1800-16, ensuring key generation (e.g., using 2048 or above key bit size), and implementing principles of least privilege access controls to prevent unauthorized access.

Our PKI assessment approach focused on automating certificate and key lifecycle management processes, reduced manual workload, and minimizing the risk of certificate outages. For example, automated certificate expiration alerts help to notify stakeholders in real-time, ensuring proactive and automated renewals.

Additionally, we recommended an automated backup process for CA databases to ensure data recovery that provided enhanced visibility. We standardized PKI policies for consistent certificate management with the goal to phase out risky self-signed and unmanaged wildcard certificates.

Our gap analysis also emphasized the importance of centralizing certificate inventory to track and monitor certificates across on-premises and cloud environments. Our senior manager’s aim was to achieve a “single pane of glass” view, which would enable tracking and monitoring of certificate status, ownership, and dependencies, addressing blind spots and improving accountability.

Impact

Throughout the project, we prioritized identifying the root cause of their security challenges and bridging the gap between their current PKI environment and long-term security goals. Our approach focused on providing a strategy and detailed remediation plan or recommendations to automate CLM processes and incorporate the best practices in day to day operations.

The organization achieved significant improvement in strengthening security posture by automating certificate lifecycle process from issuance to renewal and key management processes, which minimized the reliance on manual interventions. One notable result was their ability to actively manage certificate renewals to prevent service disruptions caused by expired certificates.

The organization achieved continuous operations without service disruptions by automated alerts and certificate renewal process.

Additionally, root and issuing CA’s private keys were securely stored and managed by utilizing the Hardware Security Module (HSM). Strong access controls were ensured, with clearly defined morals and responsibilities within the organization to ensure trust in certificate operations.

As a result of our assessment the organization adopted a password-less approach to strengthen security and simplify user authentication. Certificates were deployed across all endpoints, including laptops, mobile phones, internal web servers, and IoT devices.

The organization established standardized and centralized processes for managing its PKI. This included managing how certificate signing requests were generated, approvals were handled, and certificates were tracked and monitored in the certificate inventory.

The organization focused on creating a centralized certificate management system which helps the team to ensure which certificates are active, who owns them, and which one needs immediate attention.

By keeping an eye on upcoming expirations, the organization avoids unexpected issues like service disruptions.

Conclusion

Where digital trust is the foundation of every organization, managing PKI effectively is not just about keeping things running smoothly but a strategic imperative. Our comprehensive PKI assessment enabled the healthcare to transition from a fragmented PKI to a secure and scalable PKI.

The organization’s transition to standardized PKI environment has enhanced visibility in their PKI, helping them address upcoming certificate expirations and avoid costly outages. This approach shows how a simple, well-planned systems can make a big difference, ensuring trust and security for years to come.

Going forward, the organization plans to expand these capabilities by automating certificate deployment and management, integrating PKI with existing identity and access management system, and leveraging PKI for emerging use cases, such as IoT device security.