Roger's Information Security Blog

The past couple of weeks I’ve been working on implementing a PKI solution from Verisign.
Its been a long road. Its been a couple years at least since I first started working on PKI implementation products. The purchase was delayed a couple of times. Then the implementation was delayed. Once we got to doing the implementation, it was rather straightforward. I’m happy with the way things are going, and I’ll be happier as we get the product deployed to larger test groups.
There are a couple of things we still need to work out:
1. I’ve got a couple users where they could enroll for the encryption certificate and it was escrowed correctly, but there was a cipher issue and the certificate couldn’t be added to the browser.
2. The last two modays I’ve found the Luna SA (a HSM) were not bound to Active Directory. I’m still gathering information on this. I t hink when the domain controller reboots, the Luna fails to rebind on its own, but I need to verify this.
3. On the RA, if I do a service verification (-sV) nmap scan on its port (2003/TCP), the memory spirals out of control. Multiple scans will crash it. That issue will hopefully be fixed in the next version. For now, I’m just going to have to avoid scanning that port.
Professional Services said, “[the application] was designed to be deployed in a control setting. The service wasn’t designed to be robust.”
I really had a problem with that statement. I hope that was a off the cuff remark rather than official Verisign position. Internal networks behind a firewall aren’t guaranteed to be a pristine environment. I’d like my security related services to assume they are going to be attacked and be able to preserve confidentiality integrity and availability.
Unfortunately we aren’t well segmented internally. Perhaps I should consider using the Windows Firewall so that only devices that need to talk to the server on that port (such as the web server) are able to do so.
I am happy with the implementation. Any issues we’ve had are being address.

On Monday, I went to a Fred Pryor Seminar (I think that used to be called Careertrack) on Managing Emotions Under Pressure. The instructor Dee Yoh has a very interesting story to tell. I wish she had a biography or autobiography available. She is a great presenter and someone who is living the principles taught in the course.
I didn’t get a lot of new information to me, but what was important was time to think and reflect away from work and other distractions. I also realized how important it is to continue to work at managing emotions. Lack of emotional control is an impediment to career success. Successful people are always improving themselves. Its very easy for techs to focus on learning more information rather than learning the soft skills.
Rather than writing one really long blog entry today, I think I’ll be following up with more details later.