Finservs More Vulnerable to Certificate-Related Outages

Financial services organizations are more likely to have digital certificate-related outages than other industries. In the last six months, 36% experienced an outage that impacted critical business applications or services.

That is among the results Salt Lake City-based Venafi, a provider of machine identity protection, found in its a study examining the scale and frequency of certificate-related outages in financial services organizations. Over 100 chief information officers in the financial services industry from the U.S., U.K., France, Germany and Australia participated in the study.

Venafi’s analysis found financial services CIOs are most concerned about the impact of certificate-related outages on their customers.

“Organizations from every sector struggle with certificate-related outages on critical infrastructure, but it’s clear that these issues are even more pronounced in the financial services industry,” Kevin Bocek, vice president of security strategy and threat intelligence for Venafi said. “The entire sector is focused on trust, performance and reliability, so they can’t afford service interruptions.” Bocek pointed out concurrently, open banking initiatives have transformed the industry. “As a result, financial services organizations rely on machine identities to secure and protect a wide range of business-critical, machine-to-machine communication. Unfortunately, these critical security assets are often unmanaged and unprotected, even though they protect mobile applications, containerization initiatives and cloud architectures.”

The report revealed leading analysts place the average cost of a critical infrastructure outage in Global 5000 organizations at about $5,600 per minute, or more than $300,000 per hour. For large networks, severe outages can take days to resolve and cost as much as $500,000 per hour or more. Certificate-related outages can be especially problematic in highly digital sectors like the financial services industry, where the effect on business revenue often goes hand in hand with customer experience and satisfaction.

Additional findings from Venafi’s study include:

• Half of the respondents showed concern for their companies’ reputations from certificate-related outages.
• Some 34% said they are concerned the increasing interdependencies between technologies and services will make future outages even more painful.
• Certificate usage is skyrocketing in the financial services sector: 82% estimate certificate usage in their organizations will grow by 25% or more in the next five years, with 56% anticipating minimum growth rates of more than 50%.

Secure sockets layer/transport layer security digital certificates enable authentication and encryption by identifying machines. According to the study, when these SSL/TSL certificates expire, they can bring down the services they support. “Outages caused by expired digital certificates are a routine occurrence for most CIOs. Because the symptoms of expired certificates mimic many other types of network failures, they are notoriously difficult to diagnose and can be extremely time-consuming to resolve. And when these certificate-related outages occur on critical infrastructure, the impact and costs can increase dramatically.”

Venafi maintained organizations will spend over $10 billion to protect and manage passwords, but they will spend almost nothing to protect and manage machine identities. Most organizations do not have a clear understanding of how many machine identities are in use, which devices are using them, and when they will expire. This lack of comprehensive visibility and intelligence leads to outages.