Renew an issuing CA certificate once before replacing the Strategic Medium key pair Use certificate expiration events in Windows 8® and Strategic Medium Windows Server 2012® and above to assist in expiration notification Match the strength of asymmetric key algorithms with the Strategic Medium strength of the hash algorithm Use the correct key usage for each certificate use case Strategic Medium Determine the extended key usages for each PKI use case Strategic Medium Constrain issuing CAs (use the path length constraint to Strategic Medium ensure that CA can only issue end-entity certificates and limit application policies) Protecting CA Keys and Critical Artifacts Recommendation Tactical or Impact Strategic Level Tactical High If using network HSMs for offline CAs, do not connect the HSM to a routable network Internal Create enough HSM tokens to account for disaster recovery Strategic Medium Use tamper-evident containers/packaging to store PKI Tactical High artifacts such as HSM tokens or backup data Internal Store PKI artifacts in a climate controlled location Tactical Medium Maintain an auditable chain of custody of PKI artifacts Strategic High Internal Maintain an inventory of PKI artifacts Strategic High Internal
Renew an issuing CA certificate once before replacing the key pair Strategic Medium Use certificate expiration events in Windows 8® and Windows Server 2012® and above to assist in expiration notification Strategic Medium Match the strength of asymmetric key algorithms with the strength of the hash algorithm Strategic Medium Use the correct key usage for each certificate use case Strategic Medium Determine the extended key usages for each PKI use case Strategic Medium Constrain issuing CAs (use the path length constraint to ensure that CA can only issue end-entity certificates and limit application policies) Strategic Medium Protecting CA Keys and Critical Artifacts Recommendation Tactical or Strategic Impact Level If using network HSMs for offline CAs, do not connect the HSM to a routable network Tactical High Internal Create enough HSM tokens to account for disaster recovery Strategic Medium Use tamper-evident containers/packaging to store PKI artifacts such as HSM tokens or backup data Tactical High Internal Store PKI artifacts in a climate controlled location Tactical Medium Maintain an auditable chain of custody of PKI artifacts Strategic High Internal Maintain an inventory of PKI artifacts Strategic High Internal
Securing%20Public%20Key%20Infrastructure%20(PKI).docx