Example Of Essay On Public Key Infrastructure

PKI fundamentals

Public key infrastructure (PKI) uses cryptography to represent the apparent key management approach. Public key infrastructure is a security model for securing web services and/or information. It is used to encrypt unreadable information at the source and to decrypt readable information at the recipient side. The term network subscriber is used in public key infrastructure to represent either an individual or organization that receives services from the internet service provider (ISP). PKI permits safe communication through implementation of IPsec or SSL protocols that permits the sending and receiving of cryptographic secured packets of any kind without any alteration (Babbidge, 2013, Kong, Seo & Kent, 2014).
PKI thus establishes and maintains reliable computer network environment by providing services for both key and certificate management. These cervices allow encryption and digital and digital signature facilities for many applications. The directories can be coupled with public key infrastructure for use in the distribution of certificates, for the applications like e-mail in which the end-user certificate have to be gotten before an encrypted message is sent. It can also be used to distribute certificate status information such as certificate revocation lists (CRLs).In addition; it can be used for the distribution off private keys where portability is needed in environments where users do not use the same machine every day. PKI can therefore used to tackle identified threats in cloud computing dealing with integrity, confidentiality, authenticity, data availability and communications (Babbidge, 2013, Kong, Seo & Kent, 2014).

Benefits to the organization

The features and functions of PKI can benefit the information and security department of an organization by ensuring that the communicated information by the organization is completely secured. This enhances optimum integrity, confidentiality, authenticity and non-repudiation. There is also distributed denial of service (DDOS) which also translates to improved security benefit to the organization attack blockage. It also provides a measure of protection against network machines that offers services to the internet such as public web servers. PKI also provides security of an application layer gateway to the internal network of the organization. In addition, an attacker will have to break through the access router, the bastion host and the choke router in order to get into the services on the internal network (Onimode & Danjuma, 2014).

How PKI can help in the signing the company software

The PKI could assist in the process of signing the company’s software by requesting input authentication information from the signing party and receiving authentication information input from the signing party. PKI can also help in the creation of digital electronic signature on the unsigned software document provided by presentation authority, providing certification authority for the internet connected computer to be used by the prospective signing party..It also helps in destroying the private key and transmitting the signed electronic document to the signed document storage database for access by relying party. PKI therefore verifies the application software that originates from the intended author. The customer can know that the software is authentic when the software meets the recommended security attributes such as data integrity, information availability as well as confidentiality (Oswalt, 2014,Barrera & Van, 2011).

Public versus in-house certificate authority

Public certificate authority can be used for certification of public keys while in-house certificate authority can be used to certify private keys. But both the authorities use certificates to store public and private keys respectively. The software certified by public certificate authority can at times be less secure since they can be accessed easily by many organizations and/or customers who wish to use them. On the other hand, in-house certified software is more secure to the particular organization or company that develops it since they are only specific for the organization and thus free from external attack (Agrawal, 2012).

Recommendation

I would like to recommend the organization to use public certification authority. This is because the organization largely uses email clients, virtual private network (VPN) products, Web server components, and domain controllers would in addition to Microsoft Server 2012 Active Directory software products. All these products are not in-house developed software and hence can only be certified and authenticated through public certification authority.

References

Babbidge, J. (2013). Key Management—Fundamentals. Datenschutz und Datensicherheit-DuD, 37(8), 497-501.
Kong, D., Seo, K., & Kent, S. (2014). Template for a Certification Practice Statement (CPS) for the Resource PKI (RPKI).
Onimode, B. M., & Danjuma, K. J. (2014). Issues And Challenges of Network Security In the Africa Environment.
Oswalt, R. T. (2014). U.S. Patent No. 20,140,331,041. Washington, DC: U.S. Patent and Trademark Office.
Barrera, D., & Van Oorschot, P. (2011). Secure software installation on smartphones. IEEE Security & Privacy, 9(3), 42-48.
Agrawal, M. (2012). Nation Technologies. Journal of Information Technology Education: Discussion Cases, 1(1), 1-19.