Lack of CLM maturity is putting organizations at risk

More than a year after the historic and damaging SolarWinds attack, nearly 65% of organizations still are unable to secure and govern the growing volume of machine and application identities in the form of digital certificates, the backbone of enterprise security, according to a report from AppViewX and the Ponemon Institute.

The report, based on a survey of 1,586 IT and Security professionals on the challenges and strategies in digital identity and access management (IAM), found that more than half of respondents say their organizations have experienced one or more security incidents or data breaches due to a digital-certificate related compromise within the last two years.

The importance of securing digital certificates

• The root causes of security incidents include a cyberattack (57%), a certificate authority (CA) compromise (49%), or employee/third-party negligence (48%)
• Of organizations that fell victim to a data breach, 58% of the organizations experienced severe or very severe financial consequences
• To prevent these incidents from occurring, only four in 10 organizations have an enterprise-wide security strategy for managing cryptographic keys and certificates

Recognizing these issues, many organizations have started to shift their priorities, putting greater emphasis on machine identity management (MIM), as well as managing and securing digital certificates (54%) versus human identities, such as usernames and passwords, (46%), which they feel are less important. In fact, organizations are set to spend around $1.2 million this year to manage and secure their certificates. Despite this, only one third of respondents say they have an accurate inventory of all of their certificates – a lack of comprehensive visibility that can prove damaging to their overall security postures.

“The fact that companies are spending such an exorbitant amount on managing and securing digital assets, yet less than 15% of respondents consider their current CLM programs to be mature, is concerning to say the least,” said Gregory Webb, CEO of AppViewX.

“With nearly half of organizations routinely experiencing security incidents from certificate expiries, it’s no longer responsible or feasible to use manual, siloed tactics and systems or legacy antiquated tools in a CLM program. Adopting a zero trust strategy bolstered by automation is the only cost-effective and viable way forward.”

Half of respondents not only view automation as a key component to their CLM programs but also use an identity-first approach that puts identity at the center of zero trust security strategies.

Additional findings

• 52% of respondents say their organizations use automation to manage certificates
• Of those who are automating, the benefits include: ensures tasks are performed consistently and improves security by removing administrator access to keystores
• Financial services and public sector are most likely to automate the management of certificates

“Our research with AppViewX reveals there’s been a great awakening for a large number of organizations that recognize the importance of a CLM program, but it’s also unveiled the fact that there’s a false sense of security that leaders at these organizations are effectively capable of managing their digital certificates through current tactics,” said Larry Ponemon, chairman of the Ponemon Institute. “I’m confident that CLM automation will be what helps organizations accelerate growth, enable modernization, and create scalable foundations in the future.”