Monitoring Public Key Infrastructure Recommendation Tactical or Impact Strategic Level Monitor Active Directory® for changes groups that control Tactical High “Cert Internal access to CAs, membership in the Publishers” group, changes to privileged and VIP accounts, and unauthorized changes to certificate templates Record and review physical access events Tactical High Internal Record and review all physical access to HSMs Tactical High Internal Record and review logs from network equipment that Tactical High supports PKI Internal Record and review physical access to PKI artifacts, such as Tactical High access to Internal Configure Windows® audit policy to enable auditing for Tactical Medium Certification Services Tactical High Monitor changes to the CA registry Internal Monitor for changes to certificate templates Tactical High Internal Compromise Response Recommendation Tactical or Impact Strategic Level Strategic Medium Identify critical systems and processes that are dependent on PKI Develop a basic plan of action for compromise before a Strategic Medium compromise occurs
Monitoring Public Key Infrastructure Recommendation Tactical or Strategic Impact Level Monitor Active Directory® for changes groups that control access to CAs, membership in the “Cert Publishers” group, changes to privileged and VIP accounts, and unauthorized changes to certificate templates Tactical High Internal Record and review physical access events Tactical High Internal Record and review all physical access to HSMs Tactical High Internal Record and review logs from network equipment that supports PKI Tactical High Internal Record and review physical access to PKI artifacts, such as access to Tactical High Internal Configure Windows® audit policy to enable auditing for Certification Services Tactical Medium Monitor changes to the CA registry Tactical High Internal Monitor for changes to certificate templates Tactical High Internal Compromise Response Recommendation Tactical or Strategic Impact Level Identify critical systems and processes that are dependent on PKI Strategic Medium Develop a basic plan of action for compromise before a compromise occurs Strategic Medium
Securing%20Public%20Key%20Infrastructure%20(PKI).docx