Cyber Defense Magazine - Annual RSA Conference 2019 - Print Edition

O2, Ericsson, and Equifax:
How Certificate Expirations
Led to Some of the Largest
IT System Failures of the
Last Two Years
By Tim Callan, Senior Fellow, Sectigo
Our modern IT landscape depends
fundamentally on digital certificates.
Certificates are nearly ubiquitous in
contemporary computing systems and
permeate every aspect of our digital lives.
They are essential to the secure functioning
of our business processes, communication,
retail purchasing, utilities, transportation
systems, personal electronics, and so much
more. Virtually no digital process or device
would securely operate without the use of
certificates.
Each certificate authenticates the identity of
a machine, device, or software operation to
ensure that only the intended connections
are occurring, and most systems won’t enable
encryption unless certificates are available.
This latter fact is because encryption on its
own does not constitute protection if the
encrypted information might wind up in the
hands of the wrong party.
Certificates must be issued by a Certificate
Authority (or CA), which is the trusted authority
for identity on that particular network. For
internal uses like IoT networks or enterprise
device certificates, the company that owns
the devices can be the Certificate Authority.
But for the public internet (including use for
web sites, server-to-server connections, or
email) certificates need to come from a public
CA that has roots universally trusted by the
systems on the internet.
With so much depending on certificates, it
may not be surprising that an unexpected
expiration can cause an application to stop
working or security to lapse. in fact, it was
revealed in December that the expiration
of two certificates disrupted the lives of
hundreds of millions of people. Early in the
month, mobile service outage for tens of
millions of customers using O2, Softbank,
and other services ultimately owed itself to
the expiration of a certificate that was part of
the backend data service Ericsson provided
to mobile service providers around the world.
And then the following week, the House
Oversight Committee released its report on
2017’s Equifax data breach.
December’s mobile outage affected carriers
in eleven countries for as long as a day. The
consequences to the carriers were huge. O2
gave all affected customers a credit worth two
days of their data plans. Softbank experienced
this outage a day before its IPO – a tremendous
black eye exactly when the technology giant
was looking for investor confidence. And it is
reported that O2 could penalize Ericsson up
to $100 million for failure to meet its SLA.
70 Cyber Defense Magazine - Annual Print Edition 2019