How a Single Digital Certificate Expiry Impacted 11 Countries?
It was early December 6th 2018, a cold winter morning when the security team at Swedish multinational networking and telecommunications company Ericsson received the jolt of their lives.
The impact?
Over 32 million people in the United Kingdom lost access to their 4G network and SMS’s on December 6. Beyond the United Kingdom, the outage reached 11 countries including Japan. Softbank even released a statement laying the blame for its network outage on Ericsson.
Certificate outages and its impact have a snowball effect. It gathers momentum and leads to a large catastrophe impacting every stakeholder in the organizational structure.
The reason for Ericsson to face such a problem was due to the lack of a robust certificate monitoring system that would have prevented this outage.
Save Your Business from Certificate Expiry-Related Outages Now!
The world moves on:
From this incident in 2018, Ericsson apologized publicly and decommissioned the software that managed its certificates. The world of today is far different to the one in 2018. It has gotten much more connected. The dependencies on technology and machines become infinitely important.
A recent study from Gartner that the Internet of Things (IoT) market would grow to 64 billion endpoints.
Now imagine each of these 64 billion endpoints being connected to a digital certificate. The sheer value that gets attached to an outage becomes boggling for the human mind to fathom. Application outages that get caused by expiries of these certificates can literally put brakes to work and by large life.
Consider this unpredicted side-effect from the Ericsson outage. The local government Council in Angus, Scotland, had to share a public statement that “All parking meters in our off-street car parks are unavailable for use due to network issues.”
Knowing all there is to know:
“The faulty software that has caused these issues is being decommissioned and we apologize not only to our customers but also to their customers,” said Börje Ekholm, President and CEO, Ericsson. “We work hard to ensure that our customers can limit the impact and restore their services as soon as possible.”
Failure to detect that a digital certificate used by Ericsson for its SGSN-MME (Serving GPRS Support Node – Mobility Management Entity) had expired, the software that Ericsson had used did not deliver.
The reason? It simply never made to a point to discover all the certificates within Ericsson’s vast infrastructure.
Discovering certificates and ensuring ways that the process is not just effective but completely foolproof is a key requirement to avoid such a problem. Optimizing devices and IP networks scan to discover certificates would be an effective way. Also, monitoring expirations, and renewals of certificates on time are again areas that really need to be stressed on to avoid such outages.
Solving a known problem:
Outages are caused due to network’s Public Key Infrastructure (PKI) being compromised. And once affected entities on the network are considered invalid, the rest of the internet stops interacting with them.
A certificate that has expired, is compromised, or has gone rogue is the definition of a security lapse, and accompanies the possibility of application downtime, outages, or even data breaches, which could set victims back by multiple million dollars in damages.
End-to-end certificate lifecycle management helps eliminate outages and prevent attacks, thereby improving an organization’s security posture.
One such option is AppViewX CERT+, the next-gen machine identity platform that ensures a shift from reactive to proactive mode to eliminate outages and prevent data breaches.
Aftermath:
Certificate lifecycle automation tools provide end-to-end automation of the process. Once the tool is integrated with an environment, it allows for zero-touch execution of certificate renewals, monitoring, discovery, revocation, and more.
“During the course of December 6, most of the affected customers’ network services have been successfully restored. We are working closely with the remaining customers that are still experiencing issues.” This was what a press release read on December 6 from Ericsson.
A colossal problem that arose from one expired digital certificate.
Act now and bridge the cybersecurity gap.
Do you want to manage your machine identities better?
The post How a Single Digital Certificate Expiry Impacted 11 Countries? appeared first on AppViewX.
*** This is a Security Bloggers Network syndicated blog from Blogs – AppViewX authored by AppViewX. Read the original post at: https://www.appviewx.com/blogs/how-a-single-digital-certificate-expiry-impacted-11-countries/
