Public Key Infrastructure (PKI) was globally accepted in the mid 1990's. PKI can be thought of the Authentication, Encryption and Decryption of all digital devices and all data. Think modern day Enigma or Lorenz encryption machines as used in the Second World War that Alan Turing and William Tutte cracked the codes on and you're thinking on the right lines.

PKI is made up of Digital Certificates and Encrypted Keys. It is used to identify and encrypt billions upon billions of messages daily in the totally reliant, digital world of communication. Digital certificates in essence take Plain Text data, just like this sentence, and encrypt it into Ciphertext. Once it is received, the recipients PKI, (if trusted) deciphers the text back into plaintext. This exchange of data is seamless. However, if either part is insecure, a Man in the Middle attack (MiTM) can easily be achieved and result in plain text exfiltration. Ransomware has become so popular because organisations have unfortunately a lack of PKI controls and their data can be accessed, at rest (on a server) or in flight (being sent to or from a server) and remain in plain text throughout. Criminals can capture or exfiltrate that data and then hold it to ransom. This situation then quickly, and unequivocally falls foul of all Privacy laws including UKDPA and GDPR.

Certificate Authorities (CA's) issue digital certificates in their billions and certificates typically last for 12 months. Many CA's have become household names such as Digicert, GoDaddy and Let's Encrypt. Certificates, have access, and privileges and due to their sheer numerical scale, few, if any companies know what digital certificates make up their PKI or Network. It is why the world's first digital cyberattack (cyber warfare) used digital certificates and weaponised them to create Stuxnet by planting malicious code into them. These weaponised (Microsoft) digital certificates were readily accepted by the Iranian Nuclear power facility in Natanz and used. After 13 days they triggered the malicious code. This resulted in centrifuge disruption resulting in mass destruction through harmonic rupturing. Stuxnet, and more latterly, SolarWinds' cyberattack in December last year, the worlds largest ever cyberattack on thousands of consequential hacks including the US Government, both used the lack of PKI management to disguise and Trojanized their attacks.

To put into some form of assembly, the criticality of authentication, and encryption has been eroded at every turn, not just by, let's call it human error, but by lack of knowledge, or of course, complicit behaviour. This includes many CA's themselves who are continually getting it so, so wrong.

This discussion will try and bring awareness as well as a far better understanding of PKI and the criticality of website, server and internet security as without these areas being secure, every single £ spent will be undermined...

Speaker:

Andy Jenkinson is a senior and seasoned innovative Executive with over 30 years' experience as a hands-on lateral thinking CEO, coach, and leader. A 'big deal' business accelerator, and inspirational, lateral thinker, Andy has crafted, created, and been responsible for delivering 100’s £millions of projects within the Cyber, Technical, Risk and Compliance markets for some of the world's largest, leading organisations. Andy has a demonstrable track record of large-scale technical delivery and management within many sectors including, Professional, Managed, and Financial Services.

More latterly Andy was one of the first, and very few people to discover the plethora of insecure SolarWinds domains post their massive cyberattack last year. It has since been proven that Andy’s version of the attack (and many others) of an insecure subdomain being hijacked and a nefarious website being stood up, has now become common knowledge, and widely accepted as being the initial access and root cause of the initial infiltration (Sunburst). Andy’s research and paper was presented to the United States Senate Intelligence Committee overseeing the SolarWinds breach earlier this year.

Following on from the success of Andy’s first book, Stuxnet to Sunburst, 20 years of digital exploitation and cyber warfare, Andy has just finished writing his second book on his experience and in-depth research of over 1000 companies, all of whom have been victims of cyber and ransomware attacks. The book is titled “Ransomware and Cyberwar, the global economic shift”.

Earlier this year Andy was delighted to accept an invitation to sit on the Council of, The International Advisory for Human Health, Education and Research Foundation. Andy is also a CyberTheory Institute Fellow