Oh, those pesky X.509 certs. They can cause so many problems with code releases. Of all the things in cybersecurity, digital certificates are probably one of the most important elements of security, but they are possibly one of the least understood. Why? Because education around encryption tends to get past the understanding the meaning of the acronym and stop just after knowing that AES is a symmetric key method and that RSA is a public key technique.
Now researchers have found that they played a key part in the SolarWinds attack:
This article is interesting as provides a number of recommendations that can be applied into many high-risk environments:
Never store code-signing keys on developer workstations, web servers or build servers. Private keys should be kept in a FIPS 140–2 validated HSM.
This is a fundamental one. One of the main uses of a certificate is to hold the public and private key for code. When the code is built it is signed by the private key of the development…
