All UK organizations have faced multiple attacks on encryption and digital certificates over the past two years.
The Ponemon Institute found that attacks are becoming more common as the number of keys and certificates deployed across infrastructure such as web servers, network devices and cloud services has increased by 40% to nearly 24,000 per enterprise over the past two years.
Russian cybercriminals, for example, recently stole digital certificates from one of the top five banks, which enabled them to steal 80 million records, while another attack allowed hackers to steal data from 4.5 million healthcare patients.
Despite the ubiquity of attacks, 63% of businesses don’t know where all their keys and digital certificates are or how they’re used. But at least the attacks have led to self-awareness: 60% of all respondents agreed that they need to do a better job of addressing vulnerabilities related to keys and certificates. Also, 54% stressed that the trust provided by keys and certificates, which are essential for online banking, shopping and management, is at risk.
“With the growing wave of attacks on keys and digital certificates, it’s important for businesses to truly understand the dire economic consequences,” said Larry Ponemon, president and founder of the Ponemon Institute. “We couldn’t manage the digital economy without the trust system they create. Organizations need a wake-up call like this to realize that they can no longer blindly trust keys and certificates that are increasingly being abused by cybercriminals.”
The report highlights that over the next two years, the potential financial risk faced by UK businesses from attacks on keys and certificates is expected to reach at least £33 million.
As for security professionals in particular, they said they fear a “Cryptoapocalypse” event. Cryptoapocalypse, coined by researchers at Black Hat 2013, is no match for Heartbleed in scope, complexity, and time required to recover.
