4 Challenges and Solution for Public Key Infrastructure

Public Key Infrastructure is widely used in every business part right now. However PKI still facing a lot of challenges. Here is the challenges and solution for Public Key Infrastructure management.

Challenges

1. Not all applications are already PKI-enabled or PKI-aware. Given that PKI is an underlying infrastructure, non integration with various applications makes it more difficult to deploy.

2. PKI is based on the authentication, or trust, of the digital credential. The amount of effort for authentication can be significant for higher levels of trust.

3. Generally, consulting or specific skill sets are required for most major PKI implementations (whether they are outsourced or done in-house). Not all applications or PKIs are seamless and user-friendly due to poor integration with other applications.

4. The return on investment (ROI) for a PKI alone is zero given that it is an infrastructure and not a direct end-user application. The ROI must be based on the applications built on top of PKI. This is dependent on the points made previously.

Solution

1. Increase the ease of use because the interface and the functions of the core application are the focus of the user experience (versus the PKI engine). In this manner, the user can be trained on the end application, which reduces the skill set and time required for the organization to become productive with the business application.

2. Decrease the expense required for authentication as more and more applications are used for the same digital credential (via economies of scale). A good example of this can be seen in the United States’ custom of using the driver’s license as a uniform identifier. The driver’s license is used for authentication not only for driving, but also as proof of age to allow purchase of age-restricted items, proof of identity for credit card or check transactions, and even as partial proof for eligibility for employment. PKI, through its use of digital credentials, has this ability to be a universal credential among many different applications ranging from email to network sign-on.

3. Decrease in consulting or specific skill sets because the PKI is already predeployed due to the integration. Consulting resources, if needed, can then focus on custom applications for specific companies, as opposed to deployment or implementation consulting.

4. ROI can now be focused on the applications and the business problems it solves, just as other IT projects are viewed today. Examples could include saving expense report processing by moving from a physical, paper-based process to an online, all-digital process. The digital credential issued through the PKI can be used to bind the information on the expense report legally, as well as make post-signature changes evident. An ROI in this case could easily be measured, unlike the case if only the PKI was being examined.

The original list from PKI Security Solution for the enterprise by Kapil Raina