staging-devopsy.kinsta.cloud

Tag: DigiCert

  • DigiCert Allies With ReversingLabs to Secure Software Supply Chains

    DigiCert Allies With ReversingLabs to Secure Software Supply Chains

    DigiCert today announced it has allied with ReversingLabs to integrate binary analysis and threat detection capabilities with a code signing service it provides.

    Deepika Chauhan, chief product officer for DigiCert, said the addition of these capabilities to the DigiCert Software Trust Manager service would make it simpler for organizations to operationalize a methodology for securing their software supply chains. The capabilities are designed to be embedded within continuous integration/continuous delivery (CI/CD) pipelines.

    In addition to being a certificate authority, DigiCert’s Software Trust Manager service automates code signing workflows. ReversingLabs, meanwhile, just added the ability to detect secrets exposed in application binaries to its Software Supply Chain Security (SSCS) platform. Those capabilities can identify secrets inadvertently left in applications as plain text, can identify secrets that can be discovered because of weak cryptography and also includes scripts that scan for malware and can generate software bills of materials (SBOMs).

    Chauhan said when combined with DigiCert Software Trust Manager, it becomes possible for the two companies to provide a comprehensive approach to detecting malware, software tampering, inclusion of secrets and certificate misconfigurations in any type of software.

    A recent ReversingLabs survey found 87% of respondents detected significant risks in their software supply chain in the last year, with software containing vulnerabilities (82%) followed by secrets leaked through source code (55%), malicious code (52%) and suspicious code (46%) posing the most serious risk to the business.

    A full 88% said software supply chain security is an enterprise-wide risk, but only 60% said their software supply chain defenses were up to the task. Nearly two-thirds (65%) of respondents, however, acknowledged their organization’s software supply chain security program wasn’t as mature as it should be. As a result, 80% are currently focused on improving security for the software supply chain, with 96% noting a more comprehensive approach to software supply chain security that detects more than vulnerabilities is needed.

    It’s not entirely clear just yet whether development teams or cybersecurity teams will be taking the lead in terms of driving the adoption of DevSecOps best practices to secure software supply chains. It is clear that securing software supply chains in the wake of a series of high-profile breaches is a much higher priority.

    Erik Thoen, director of product management for ReversingLabs, said as a result, it’s only a matter of time before development teams and cybersecurity professionals are forced to work more closely together than they have in the past.

    In the longer term, a wave of legislation in the U.S. and Europe will soon require organizations to embrace DevOps best practices to address increased potential liability that might stem from an application breach. A proposed Cyber Resilience Act currently being negotiated by the member states of the European Union seeks to require organizations that sell internet-connected hardware platforms to ensure both their devices and their software comply with cybersecurity best practices. In the U.S., meanwhile, a National Cybersecurity Strategy proposal put forward by the Biden administration seeks to hold organizations that collect data or build software more accountable for breaches.

    While both proposals are a long way from becoming law, it’s clear governments around the world are concluding the only way to ensure better cybersecurity is to require it.

  • DigiCert Launches CT Log Monitoring, Now Available in Secure Site Pro

    With access to DigiCert CertCentral® for easy certificate management, Secure Site Pro provides advanced brand and website threat protection, as well as a new PQC test kit

    LEHI, Utah (December 10, 2019) — DigiCert, Inc., the world’s leading provider of TLS/SSL, IoT and PKI solutions, today released a new CT log monitoring service for advanced brand protection. The service is available in DigiCert Secure Site Pro, the first TLS product to offer CT log monitoring along with other industry-leading features such as DigiCert’s recently unveiled post-quantum computing (PQC) test kit.

    Secure Site Pro’s CT log monitoring service will help companies protect their brands from online fraud. Logging and monitoring the issuance of TLS certificates via CT log monitoring is quickly becoming mandatory for protecting government agencies and large organizations, said DigiCert Chief of Product Jeremy Rowley.

    “No other Certificate Authority product includes default access to CT log monitoring services for quick and easy visibility,” Rowley said. “DigiCert Secure Site Pro is offering an API cloud-based service that continuously monitors CT logs, escalates certificates issued outside of a company’s approved accounts and notifies them of suspiciously issued certificates.”

    CT log monitoring helps enterprises

    • gain visibility of every domain with global monitoring and tracking against multiple CT logs,
    • cut down on time and effort by using automated checks for non-compliant certificates, and
    • ensure every domain is trusted, with full oversight of which authority issues each certificate.

    All Secure Site Pro certificates come with access to the award-winning DigiCert CertCentral management platform, which features automation solutions such as ACME, SCEP, EST and GraphQL protocols, to handle certificate issuance, installation, discovery, renewal, revocation, remediation and other tasks. CertCentral also supports multiple orchestration layers.

    Other unique premium features of Secure Site Pro certificates include priority support and validation, a $2 million warranty, and the most recognized trust marks in the world: the Norton Seal and the DigiCert Seal.

    “Managing and maintaining multiple website security solutions is time-consuming, complicated and expensive for IT teams,” said Rowley. “DigiCert Secure Site Pro is an all-in-one website security solution that saves companies time and energy. Secure Site Pro is the industry’s best TLS solution for securing important websites, where complete crypto awareness is a necessity.”

    Additionally, DigiCert has conducted extensive testing on post-quantum cryptography, leading to its recent release of a PQC test kit for customers. Organizations purchasing Secure Site Pro certificates can use the kit to test their systems for PQC compatibility and future-proof their long-lasting applications. Customers may create their own private hybrid certificates, which implement post-quantum encryption together with classical cryptographic algorithms to preserve backwards compatibility.

    “Quantum computing threats to today’s encryption protocols may be years away, but companies need to plan now, especially for Internet of Things devices and applications built today and expected to be safe in 10 years or less,” said Rowley. “Our work with technology partners is making it possible.”

    To learn more about Secure Site Pro’s features and benefits, visit digicert.com.

    About DigiCert, Inc.

    DigiCert is the world’s leading provider of scalable TLS/SSL, IoT and PKI solutions for identity and encryption. The most innovative companies, including 89% of the Fortune 500 and 97 of the 100 top global banks, choose DigiCert for its expertise in identity and encryption for web servers and Internet of Things devices. DigiCert supports TLS and other digital certificates for PKI deployments at any scale through its certificate lifecycle management platform, CertCentral®. The company is recognized for its enterprise-grade certificate management platform, fast and knowledgeable customer support, and market-leading security solutions. For the latest DigiCert news and updates, visit digicert.com or follow @digicert.

  • DigiCert Acquisition by Clearlake Capital Group and TA Associates Closes

    DigiCert to accelerate investment in automation and certificate management solutions to support customers and fuel new growth
    LEHI, Utah (October 16, 2019) — DigiCert, Inc., the world’s leading provider of TLS/SSL, IoT and PKI solutions, announced today that leading private equity firms Clearlake Capital Group, L.P. (“Clearlake”) and TA Associates have completed their previously announced investment in DigiCert. Terms of the deal are not being disclosed.
    “DigiCert is excited to work with Clearlake and TA Associates as our new lead investors, and to continue our leadership in providing the best TLS/SSL products and solutions, focused on improving and automating certificate management,” said DigiCert CEO John Merrill. “We are confident in our vision for growth and the increasing value we’ll bring to our customers.”
    TA Associates made its first investment in DigiCert seven years ago.
    “TA has had a front-row seat to DigiCert’s impressive rise as the industry leader in its space, and we look forward to continuing to work closely with the management team to invest in and support DigiCert’s innovation and growth efforts,” said Jason Werlin, a Managing Director at TA Associates. “DigiCert has a unique opportunity to capitalize on new growth initiatives that we believe will help them better serve their customers and their industry.”

    “DigiCert has an exciting business and a compelling vision for internet security based on the company’s legacy of innovation and roadmap for building trust in identity and digital interactions,” said Behdad Eghbali, Co-Founder and Managing Partner, and Prashant Mehrotra, Partner, of Clearlake. “We are ready to leverage Clearlake’s O.P.S.® framework to help the company to continue to build upon its product offerings for customers and fuel new growth through organic investments and acquisitions.”

    DigiCert has a history of industry leadership, including being the first certificate authority to provide post-quantum cryptography for digital certificates, the first to launch an independent log for Google Certificate Transparency, and the first to offer TLS for the TOR browser. The company’s award-winning certificate management platform, DigiCert CertCentral®, automates the tasks of certificate issuance, renewal, discovery and remediation, with features including ACME protocol.

    DigiCert also leads with its certificate-based encryption, authentication, integrity and identity for the IoT. The company operates PKI for enterprise authentication and many IoT device industry consortia and manufacturers, and has issued billions of device certificates to-date. DigiCert is also developing solutions in related emerging technologies, such as blockchain.

    About DigiCert, Inc.
    DigiCert is the world’s leading provider of scalable TLS/SSL, PKI solutions for identity and encryption. The most innovative companies, including 89% of the Fortune 500 and 97 of the 100 top global banks, choose DigiCert for its expertise in identity and encryption for web servers and Internet of Things devices. DigiCert supports TLS/SSL and other digital certificates for PKI deployments at any scale through its certificate lifecycle management platform, CertCentral®. The company is recognized for its enterprise-grade certificate management platform, fast and knowledgeable customer support, and market-leading security solutions. For the latest DigiCert news and updates, visit digicert.com or follow @digicert.

    About Clearlake
    Clearlake Capital Group, L.P. is a leading private investment firm founded in 2006. With a sector-focused approach, the firm seeks to partner with world-class management teams by providing patient, long-term capital to dynamic businesses that can benefit from Clearlake’s operational improvement approach, O.P.S.® The firm’s core target sectors are software and technology-enabled services; industrials and energy; and consumer. Clearlake currently has over $10 billion of assets under management and its senior investment principals have led or co-led over 100 investments. More information is available at www.clearlake.com.

    About TA Associates
    TA Associates is one of the most experienced global growth private equity firms. Focused on targeted sectors within five industries – technology, healthcare, financial services, consumer and business services – TA invests in profitable, growing companies with opportunities for sustained growth, and has invested in more than 500 companies around the world. Investing as either a majority or minority investor, TA employs a long-term approach, utilizing its strategic resources to help management teams build lasting value in high quality growth companies. TA has raised $32.5 billion in capital since its founding in 1968 and is committing to new investments at the pace of over $2 billion per year. The firm’s more than 85 investment professionals are based in Boston, Menlo Park, London, Mumbai and Hong Kong. More information about TA Associates can be found at www.ta.com.

  • CLEARLAKE CAPITAL GROUP AND TA ASSOCIATES TO MAKE A STRATEGIC GROWTH INVESTMENT IN DIGICERT

    DigiCert will accelerate growth and innovation as market leader in TLS/SSL, PKI and IoT security solutions

    LEHI, UT, SANTA MONICA, CA and BOSTON, MA – July 9, 2019 – DigiCert, Inc., the world’s leading provider of TLS/SSL, PKI and IoT security solutions for identity and encryption, today announced that Clearlake Capital Group, L.P., a leading private investment firm, and TA Associates, an existing investor and leading global growth private equity firm, have reached a definitive agreement to make a strategic growth investment in the company. As a part of the transaction, Clearlake and TA will become equal partners in DigiCert. The company will continue to be led by CEO John Merrill and the current management team, who are investing alongside Clearlake and TA in the transaction. Terms of the transaction are not being disclosed.

    DigiCert provides certificate management platforms and industry-best customer support in multiple languages through a diverse staff, with offices located across the globe. The company combines a modern infrastructure with locally focused solutions to enhance security for its customers anywhere they conduct business and in compliance with local requirements.

    “DigiCert continues to experience strong growth within our SSL business as well as enterprise PKI and IoT security, and we are addressing the needs for improved automation and certificate management,” said DigiCert CEO John Merrill. “We’re excited to continue our partnership with TA and welcome Clearlake to accelerate our growth, advance our industry leadership and continue to innovate for our customers.”

    “Having served as an active investor in DigiCert for nearly seven years, we have had the distinct honor and privilege of watching the company flourish from a 40-person upstart technology company to a leading provider of digital certificates with more than 1,000 employees globally,” said Jason Werlin, a managing director at TA Associates. “Specifically, DigiCert’s solutions and loyal customer base have strategically positioned the company to capitalize on both organic and inorganic initiatives to further scale its business. We look forward to continuing to provide support to DigiCert and working collaboratively with management alongside Clearlake as the company enters its next phase of growth.”

    Mr. Werlin will become chairman of the DigiCert Board of Directors upon the closing of the transaction, and Hythem El-Nazer, a managing director at TA, will join the DigiCert Board of Directors.

    “DigiCert is an exciting business with visionary technology, led by John and the management team, that seamlessly addresses security needs for customers of all sizes across the globe,” said Behdad Eghbali, co-founder and managing partner, and Prashant Mehrotra, partner, of Clearlake Capital Group. “We believe the company is well positioned for further growth due to its solid base of recurring subscription revenue and significant market trends as customers increasingly demand security and identity solutions with the strongest encryption and highest authentication standards. We are pleased to join TA as partners in DigiCert and look forward to utilizing our O.P.S.® framework to support the team in continuing to aggressively grow the company organically and through acquisition.”

    DigiCert has a history of innovation, including being the first to launch an independent log for Google Certificate Transparency, offer TLS for the TOR browser and partner with Microsoft to enable EV code signing certificates. DigiCert also leads with certificate-based encryption, authentication, integrity and identity for the IoT. The company operates PKI for many IoT device industry consortia and manufacturers, and has issued billions of device certificates to-date.

    “DigiCert is grateful for the partnership with Thoma Bravo, which has allowed us to achieve operational excellence. They were the right partner at the right time to help us drive the growth that we’ve achieved,” said Merrill.

    “Our DigiCert investment is a powerful example of Thoma Bravo partnering with management to dramatically scale a business through organic growth initiatives and acquisition,” said Robert Sayle, a partner at Thoma Bravo. “DigiCert has maintained an impressive growth rate throughout our investment and is on track for continued industry leadership this year and beyond. We appreciate the commitment and partnership of John Merrill and his outstanding management team. Today, DigiCert is strategically positioned for continued success with its new partners, and we wish them well.”

    The transaction is expected to close in the second half of 2019, pending customary regulatory approvals and closing conditions.

    About DigiCert

    DigiCert is the world’s leading provider of scalable TLS/SSL, PKI solutions for identity and encryption. The most innovative companies, including 89 percent of Fortune 500 companies and 97 out of the 100 top global banks, choose DigiCert for its expertise in identity and encryption for web servers and Internet of Things devices. DigiCert supports TLS/SSL and other digital certificates for PKI deployments at any scale through its certificate lifecycle management platform, CertCentral®. The company is recognized for its enterprise-grade certificate management platform, fast and knowledgeable customer support, and market-leading security solutions. For the latest DigiCert news and updates, visit digicert.com or follow @digicert.

    About Clearlake

    Clearlake Capital Group, L.P. is a leading private investment firm founded in 2006. With a sector-focused approach, the firm seeks to partner with world-class management teams by providing patient, long-term capital to dynamic businesses that can benefit from Clearlake’s operational improvement approach, O.P.S.® The firm’s core target sectors are software and technology-enabled services; industrials and energy; and consumer. Clearlake currently has over $10 billion of assets under management and its senior investment principals have led or co-led over 100 investments. More information is available at www.clearlake.com.

    About TA Associates

    TA Associates is one of the most experienced global growth private equity firms. Focused on targeted sectors within five industries – technology, healthcare, financial services, consumer and business services – TA invests in profitable, growing companies with opportunities for sustained growth, and has invested in more than 500 companies around the world. Investing as either a majority or minority investor, TA employs a long-term approach, utilizing its strategic resources to help management teams build lasting value in high quality growth companies. TA has raised $32.5 billion in capital since its founding in 1968 and is committing to new investments at the pace of over $2 billion per year. The firm’s more than 85 investment professionals are based in Boston, Menlo Park, London, Mumbai and Hong Kong. More information about TA Associates can be found at www.ta.com.

    About Thoma Bravo
    Thoma Bravo is a leading private equity firm focused on the software and technology-enabled services sectors. With a series of funds representing more than $30 billion in capital commitments, Thoma Bravo partners with a company’s management team to implement operating best practices, invest in growth initiatives and make accretive acquisitions intended to accelerate revenue and earnings, with the goal of increasing the value of the business. Representative past and present portfolio companies include industry leaders such as ABC Financial, Blue Coat Systems, Deltek, Digital Insight, Frontline Education, Global Healthcare Exchange, Hyland Software, Imprivata, iPipeline, PowerPlan, Qlik, Riverbed, SailPoint, SolarWinds, SonicWall, Sparta Systems, TravelClick and Veracode. The firm has offices in San Francisco and Chicago. For more information, visit www.thomabravo.com.

  • DigiCert and Utimaco work on securing the future of IoT from quantum computing threats through collaboration with Microsoft

    Proof of concept lays a foundation for quantum-resistant digital certificates for IoT devices

    REDMOND, Washington, LEHI, Utah, AACHEN, Germany (February 12, 2019) — Today, DigiCert, Inc., the world’s leading provider of TLS/SSL, IoT and PKI solutions; Utimaco, one of the world’s top three Hardware Security Module providers; and Microsoft Research, a leader in quantum-safe cryptography, announced a successful test implementation of the “Picnic” algorithm, with digital certificates used to encrypt, authenticate and provide integrity for connected devices commonly referred to as the Internet of Things (IoT). This proof of concept provides a path toward a full solution, currently in development, that will protect IoT devices from future threats quantum computing could pose to today’s widely used cryptographic algorithms.

    Currently, most IoT devices use RSA and ECC to protect confidentiality, integrity and authenticity for device identities and communication. Experts from the security community, including Dr. Brian LaMacchia from Microsoft Research, predict that large-scale quantum computers capable of breaking RSA and ECC public-key cryptography will exist within the next 10 to 15 years. Although this might seem like a long time away, many devices such as connected cars, smart homes, connected cities, connected medical devices and other critical infrastructures will either live longer than this or will take longer to update.

    “DigiCert, Microsoft Research and Utimaco are collaborating today to solve tomorrow’s problem of defending connected devices and their networks against the new security threats that the implementation of quantum computers will unleash,” says Avesta Hojjati, Head of DigiCert Labs, the company’s R&D unit. “Together, we are leading the market with development of hybrid certificates that inject quantum-resistant algorithms alongside RSA and ECC to ensure long-term protection.”

    The certificates are issued by DigiCert using the Picnic quantum-safe digital signature algorithm developed by Microsoft Research. To implement this algorithm and issue certificates, DigiCert has used an Utimaco Hardware Security Module. The full solution, in development, would provide quantum-safe digital certificate issuance and secure key management, helping companies future-proof their IoT deployments.

    “The cooperation between DigiCert, Microsoft Research and Utimaco will help organizations implement secure and future-proof IoT products that are protected against the potential security threats of quantum computing,” said DigiCert CTO Dan Timpson.

    Enterprises will be able to cost-effectively deploy these solutions at any scale. Further, these companies will provide solutions and tools to manufacturers of IoT devices to remain prepared for quantum threats. The goal is to keep the sensitive information and high-value assets safe.

    “DigiCert, Utimaco and Microsoft’s successful test implementation provides a fundamental building block for the implementation of quantum-safe solutions,” said Dr. Thorsten Grötker, CTO at Utimaco. “Using these solutions, IoT manufacturers and other large organizations can innovate and develop products that are well prepared against coming quantum threats.”

    Brian LaMacchia, Distinguished Engineer and Head of the Security and Cryptography Group at Microsoft Research, said, “The work that Microsoft Research is doing with DigiCert and Utimaco is important to develop quantum-secure cryptographic algorithms, protocols and solutions today so that in the near future enterprises will be able to transition to and deploy quantum-safe cryptography. Working to ensure that their solutions are cryptographically agile will help companies avoid expensive and unscalable security practices to protect their IoT devices against future security threats.”

    About DigiCert, Inc.

    DigiCert is the world’s leading provider of scalable TLS/SSL, PKI solutions for identity and encryption. The most innovative companies, including 89 percent of Fortune 500 companies and 97 out of the 100 top global banks, choose DigiCert for its expertise in identity and encryption for web servers and Internet of Things devices. DigiCert supports TLS/SSL and other digital certificates for PKI deployments at any scale through its certificate lifecycle management platform, CertCentral®. The company is recognized for its enterprise-grade certificate management platform, fast and knowledgeable customer support, and market-leading security solutions. For the latest DigiCert news and updates, visit digicert.com or follow @digicert.

    About Utimaco

    Utimaco is an international provider of IT security solutions based in Aachen (Germany) and Campbell, CA (US). Utimaco develops hardware security modules and compliance solutions for telecommunication providers in the field of regulation. Utimaco is one of the world’s leading manufacturers in both technology segments. Over 220 employees are committed to the company´s goal to protect people, ideas and data and to create trust for the digital economy. Customers and partners value the reliability and long-term investment security solutions. Utimaco stands for recognized product quality, user-friendly software, excellent support and products that effectively meet market requirements. Find out more on www.utimaco.com.

     

  • DigiCert announces CertCentral® Enterprise, a comprehensive, all-in-one digital certificate management solution for enterprise cloud and hosted TLS/SSL environments

    CertCentral Enterprise adds notable enterprise controls and anchors the DigiCert flagship TLS platform

     

    LEHI, Utah – (January 31, 2019) — DigiCert, Inc., the world’s leading provider of TLS/SSL, IoT and PKI solutions, today announced DigiCert CertCentral® Enterprise, a leading certificate management platform for cloud and hosted environments.

    CertCentral Enterprise comprises the most modern tools and technologies, providing enterprise customers better control over certificate security and compliance. Organizations enjoy 24/7 visibility, at-scale rapid remediation, and trusted expertise and guidance to protect their businesses, customers and reputations. CertCentral Enterprise pulls together the combined strengths of DigiCert and the acquired Symantec Public Key Infrastructure (PKI) businesses.

    CertCentral Enterprise allows customers to customize and automate all stages of lifecycle management for TLS/SSL and other digital certificate types–all from an intuitive user interface. With single sign on (SSO) options, robust RESTful APIs to automate any feature, and detailed role management, users can manage all their certificates from a single, scalable platform.

    “DigiCert CertCentral Enterprise is the culmination of efforts to bring together the best features and scalability that the world’s leading enterprises expect from their certificate provider,” said Dan Timpson, Chief Technology Officer at DigiCert. “CertCentral Enterprise makes it easy for enterprise customers using a TLS management console from a formerly Symantec-owned brand to upgrade and enjoy all the features they are used to, plus several new additions. This platform is the result of customer testing and feedback, and addresses their common pain points in an intuitive way.”

    CertCentral Enterprise is a robust addition to the DigiCert TLS platform, which offers award-winning customer support, innovative and scalable infrastructure, leading certificate products such as Secure Site, and time-saving discovery and automation tools.

    DigiCert’s solution gives enterprises a more sophisticated set of account management tools so they can better govern TLS/SSL certificate deployment within their business units. The additional features in CertCentral Enterprise will enable enterprise customers to:

    • Discover and manage all publicly and privately trusted certificates across the enterprise with automated continuous search and monitoring capabilities.
    • Automate certificate management workflows via REST and GraphQL APIs and industry standard protocols such as ACME.
    • Gain insights into enterprise usage with audits and customized reporting.
    • Define custom certificate validity periods.
    • Gain value through automated proration of certificate usage.
    • Enjoy flexible payment methods and business unit segmentation.
    • Increase security with SAML single sign-on, multi-factor authentication and IP address restrictions for certificate requests.
    • Enable role-based access and customize enterprise workflows such as guest URLs for quick certificate requests.

    “Enterprises can manage everything connected to their TLS certificates in one place. CertCentral Enterprise is a comprehensive all-in-one digital certificate management platform for the cloud and hosting environments,” said Jeremy Rowley, chief of product at DigiCert. “DigiCert’s innovation will continue as we provide platforms tailored to the needs of customers. This is one of many exciting announcements to come.”

    Existing customers can get details about upgrading to CertCentral Enterprise by contacting their sales representative. Prospective customers can visit digicert.com/mpki to learn more.

    About DigiCert, Inc.

    DigiCert is the world’s leading provider of scalable TLS/SSL, PKI solutions for identity and encryption. The most innovative companies, including 89 percent of Fortune 500 companies and 97 out of the 100 top global banks, choose DigiCert for its expertise in identity and encryption for web servers and Internet of Things devices. DigiCert supports TLS/SSL and other digital certificates for PKI deployments at any scale through its certificate lifecycle management platform, CertCentral®. The company is recognized for its enterprise-grade certificate management platform, fast and knowledgeable customer support, and market-leading security solutions. For the latest DigiCert news and updates, visit digicert.com or follow @digicert.

     

  • Venafi and DigiCert Machine Identity Protection Partnership Delivers New Solution for Large-Scale Enterprise PKI

    SALT LAKE CITY – December 6, 2018 — Venafi, the leading provider of machine identity protection, and DigiCert, the world’s leading provider of TLS/SSL, IoT and other PKI solutions, today announced a new, deeper integration that simplifies and automates complex machine identity programs for the world’s most demanding, security-conscious organizations. The combined  solution enables organizations to customize and orchestrate public key infrastructure (PKI) and machine identity protection at machine speed and scale.

    “The rapid adoption of DevOps, microservices, cloud, and IoT requires a new level of technical sophistication and innovation to deliver protection for all machine identities,” said Kevin Bocek, vice president of security strategy and threat intelligence for Venafi. “The Global 5000  are looking for a certificate provider that tightly integrates with the Venafi Platform and provides them with the confidence of a complete solution. DigiCert is the leading CA of choice for large enterprises.”(1)

    The integrated solution leverages DigiCert’s industry-leading, globally dispersed, modern OCSP infrastructure and a deep API integration with Venafi’s industry-leading machine identity protection platform. The new, adaptable driver allows customers to access a rich set of new features from DigiCert CertCentral. Mutual customers can customize specific features, from fully automating certificate provisioning to enforcing internal policies, allowing them to easily address industry regulations such as PCI DSS, HIPAA  and GDPR as well as the most demanding use cases. The integrated solution also simplifies the integration of machine identity protection across a wide variety of systems and allows customers to fulfill high-value certificate requests in seconds. Venafi solutions support the most popular CertCentral features out-of-the box.

    “DigiCert enjoys a long-standing history of collaboration and integration with Venafi, and we share mutual enterprise customers that benefit from their robust platforms and services,” said Dan Timpson, chief technology officer to DigiCert. “In an era when enterprises face increasing threats from a growing landscape of connected devices and agile deployments, Venafi provides leading solutions for addressing machine identity and digital certificate management. We are looking for additional ways to work together to support enterprise customers.”

    Key features of the integration include:

    • Provides full visibility into the demand, usage and workflow of certificate services.
    • Reduces risk with automated policy and workflows, including configurable approval and authorization, and detailed logging.
    • Achieves compliance for workflow approvals, authorization and authentication.
    • Supports the full certificate lifecycle from request, issuance, and renewal to revocation.

    For more information please visit:

    https://www.venafi.com/techpartner/digicert

     

    1. DigiCert maintains the largest market share for the Alexa Top 1000 as measured by Datanyze. https://www.datanyze.com/market-share/ssl/Alexa%20top%201K/

    About DigiCert, Inc.

    DigiCert is the world’s leading provider of scalable PKI solutions for identity and encryption. The most innovative companies, including the Global 2000, choose DigiCert for its expertise in identity and encryption for web servers and Internet of Things devices. DigiCert supports TLS/SSL and other digital certificates for PKI deployments at any scale through its certificate lifecycle management platform, CertCentral®. The company has been recognized with dozens of awards for its enterprise-grade management platform, fast and knowledgeable customer support, and market-leading growth. For the latest DigiCert news and updates, visit digicert.com or follow @digicert.

    About Venafi

    Venafi is the cyber security market leader in machine identity protection, securing machine-to-machine connections and communications. Venafi protects machine identity types by orchestrating cryptographic keys and digital certificates for SSL/TLS, IoT, mobile and SSH. Venafi provides global visibility of machine identities and the risks associated with them for the extended enterprise – on premises, mobile, virtual, cloud and IoT – at machine speed and scale. Venafi puts this intelligence into action with automated remediation that reduces the security and availability risks connected with weak or compromised machine identities while safeguarding the flow of information to trusted machines and preventing communication with machines that are not trusted.

    With 31 patents currently in its portfolio, Venafi , delivers innovative solutions for the world’s most demanding, security-conscious Global 5000 organizations, including the top five U.S. health insurers; the top five U.S. airlines; four of the top five U.S., U.K., Australian and South African banks; and four of the top five U.S. retailers. Venafi is backed by top-tier investors, including TCV, Foundation Capital, Intel Capital, QuestMark Partners, Mercato Partners and NextEquity. For more information visit: www.venafi.com.

  • DigiCert Joins the Sovrin Foundation as a Founding Steward

    In addition to operating a node on the Sovrin Network, DigiCert will contribute developer resources

    LEHI, Utah and SALT LAKE CITY (June 19, 2018) — DigiCert Inc., the leading global provider of SSL and other public key infrastructure (PKI) solutions for securing web traffic and the Internet of Things (IoT), and the Sovrin Foundation, a private-sector international nonprofit, today announced the addition of DigiCert as a Steward of the Sovrin Network. As a Steward, DigiCert will operate a validator node and contribute developer resources, helping to ensure the validity, accessibility and security of the distributed ledger at the heart of the foundation’s self-sovereign identity technology.

    Self-sovereign identity refers to digital identity that is decentralized, secure, portable, private and completely trustworthy.

    “At DigiCert, we have spent nearly two decades as a public certificate authority, and recently for connected devices, refining our processes and improving industry standards for providing scalable encryption and authentication,” said DigiCert Chief Technology Officer Dan Timpson. “Our initiative with the Sovrin Foundation builds upon that experience and provides real value in advancing reliable identity and trust for today’s and tomorrow’s connected technologies seeking to use blockchain.”

    Timpson noted that DigiCert is also contributing developer resources to the open source Sovrin codebase, which is administered by Hyperledger as Project Indy. According to Timpson, DigiCert plans to lean on its extensive experience building large-scale PKI-based authentication systems to improve the security of the data written to the Sovrin ledger.

    “DigiCert is a company built upon the premise that the challenges of digital security and identity can be solved in intuitive and human ways,” said Heather C. Dahl, executive director of the Sovrin Foundation. “This is the essence of what we are doing at Sovrin — building a network that enables trusted and intuitive interactions among people, organizations and even connected devices. Both the Sovrin Network and those who use it will benefit enormously from the depth of experience that DigiCert brings to us, and we are very happy to add them as a Steward.”

    The Sovrin Network uses a purpose-built distributed ledger — technology frequently known as blockchain — to enable the secure exchange of cryptographically signed credentials. The diffuse trust model embodied in Sovrin Stewards ensures the network’s independence and protection from outside interference — further placing individuals in control of their identities and at the center of their digital interactions.

    ### 

    About DigiCert, Inc.

    DigiCert is a leading provider of scalable security solutions for a connected world. The most innovative companies, including the Global 2000, choose DigiCert for its expertise in identity and encryption for web servers and Internet of Things devices. DigiCert supports SSL/TLS and other digital certificates for PKI deployments at any scale through its certificate lifecycle management platform, CertCentral®. The company has been recognized with dozens of awards for its enterprise-grade management platform, fast and knowledgeable customer support, and market-leading growth. For the latest DigiCert news and updates, visit digicert.com or follow @digicert.

    About the Sovrin Foundation

    The international, nonprofit Sovrin Foundation is governed by a constitutional Trust Framework that ensures its independence from government or industry influence and codifies its dedication to providing self-sovereign digital identity for all. The Sovrin Network is operated by independent Stewards and uses the power of a hybrid distributed ledger as a fast, private and secure framework for providing every person, organization, and connected device a permanent identity with which to transact online and operate securely online in everyday life. Learn more about the Trust Framework underlying the Sovrin Network here.

     

  • Survey: Inviting Security into DevOps Promotes Effective Agility

    Survey: Inviting Security into DevOps Promotes Effective Agility

    Two of the biggest trends in business technology are seemingly at loggerheads with one another. Many companies are under severe pressure to digitally enable their businesses. At the same time, the need for hardened application security has never been more critical than it is now. You can deliver apps quickly and you can deliver apps securely but, generally speaking, the two things don’t happen at the same pace. The DevOps mission is aligned more with development efficiency and agility, but it’s also in keeping with the thinking behind DevSecOps. How are enterprises handling the conundrum?

    According to a new survey from identity and encryption enterprise vendor DigiCert, they are handling it quite well. The recently released “Inviting Security into DevOps” survey found that 98 percent of respondents said their companies are integrating their security teams into their existing DevOps methodologies. The survey found that 49 percent of the respondents are in the process of doing so; the other 49 percent have already done so. Those who report having already integrated security with DevOps are 21 percent more likely to report what might seem counterintuitive: They are doing well at meeting app delivery deadlines.

    “Successful security for DevOps requires a combination of culture building and the right technology,” said DigiCert CSO Jason Sabin. “Companies that can do this and bring in security at the start of a project avoid costly delays, because they deliver their project just once rather than discovering security issues late in the process.”

    The methodology for the survey, which was conducted in May, involved 100 DevOps professionals, 100 IT professionals and 100 security professionals with executive management to management titles skewing 3:1.

    The large enterprises polled for this survey agree it’s worth striving for. Some 88 percent of the respondents called security working directly with DevOps somewhat or extremely important. More than 70 percent of the respondents are concerned that if their companies don’t make this change, one or more of these negative repercussions are likely: increased costs, slower app delivery and increased risks.

    Although nearly all the respondents have integrated or are integrating security within DevOps, they’re not saying it is an easy process. Their top challenges include a lack of a champion for the transition, the security team resists the change, lack of relationship skills required to bring the teams together and it takes much more time than expected—an average of one to two years.

    How should you approach this in your company? First, recognize that it’s no panacea. It’s a logical first step, but don’t spend a year planning it, just do it. Start by appointing or identifying a leader for the project. Someone who understands both sides, ideally, and who knows how to get things done. And install a security lead at the DevOps table for all DevOps business. Integrate, standardize and invest in automating baseline security practices within DevOps workflow. Thinking that way will get you the agility you need.

    Then address what comes next. Have the team identify choke points in the application security process and develop ways to work around them or eliminate them. In other words, attack the problem head on with all your best minds. Don’t forget to look for best practices developed by others. It’s a problem a lot of companies are trying to solve, so networking with people from other companies at industry events may give you your best ideas.

    — Scot Finnie

  • Study: Half of Enterprises Have Achieved DevSecOps

    Study: Half of Enterprises Have Achieved DevSecOps

    The inclusion of IT security into DevOps processes, also known as DevSecOps, appears to be occurring at an accelerated rate. A new survey of 300 enterprise IT organizations published this week by DigCert, a provider of identity management and encryption software, finds that almost half (49 percent) of the respondents says they have completed DevSecOps, while another 49 percent say they are already working on it.

    In terms of overall impact, however, only 22 percent say they are doing well in terms of achieving and maintaining higher levels of security.

    In addition, those that have achieved DevSecOps say it took them anywhere from 12 to 14 months to make the transition. Those that have not completed the transition are estimating it will take them seven to 11 months. Based on the experience of the organizations that have completed the transition, there would appear to be a natural tendency to underestimate how much the cultural difference between developers and IT security teams can negatively impact integration objectives.

    Jason Sabin, chief security officer (CSO) for DigiCert, says that while many organizations may have brought IT security professionals into the process, an increase in the overall security of applications being built requires more time and patience, says Sabin.

    DigiCert recommends IT organizations identify an IT security champion within a DevOps process and automate the implementation of IT security controls as much as possible. Those moves can help lower developer cultural resistance to having to spend time on what often are considered mundane programming issues.

    It’s worth noting that most IT security professionals don’t have much in the way of programming skills. They can secure an application using any number of platforms that have a management console. But understanding how to employ APIs to help plug security holes before an application gets deployed is beyond the capabilities of most IT security professionals. IT security professionals can make developers aware of issues, but in general there’s not much they can do to fix the application itself.

    Also, IT security professionals typically don’t understand the amount of coding that might be required to fix an issue, and they are not always able to access the true risk associated with a specific vulnerability. All vulnerabilities tend to be treated as equal threats regardless of number of instances a vulnerability has been exploited.

    The good news is a full 88 percent of respondents saying it is somewhat to extremely important to integrate security into DevOps. Failure to do so will lead to issues such as increased costs (78 percent), slower application delivery (73 percent) and increased security risks (71 percent). Awareness of these issues should eventually lead to the development and deployment of more secure applications.

    The issue, of course, is that not every development team is equally along the DevSecOps maturity code. Because of that issue, it unfortunately may be years before the preponderance of applications running in a production environment are able to defend themselves from even the most rudimentary cybersecurity attacks.

    — Mike Vizard