[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsc-17":3},{"item":4,"lessons":18,"controls":40,"related":68},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sc-17","SC-17","Public Key Infrastructure Certificates",5,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Public key certificates must be issued under a defined certificate policy or obtained from an approved service provider, and only approved trust anchors may be included in trust stores or certificate stores.\n\n**In practice.** Doing this well means a certificate inventory, automated issuance and renewal, a governed internal PKI with protected root keys and control over which root certificates devices trust. Auditors look for the certificate policy, inventory, renewal processes and trust store configuration. Short-lived certificates with automated renewal through protocols such as ACME reduce risk.\n\n**Common gaps.** Certificates expiring unexpectedly and causing outages is common, as is shadow PKI created by individual teams. Unmanaged trust stores may include roots that should not be trusted. Private keys are also frequently stored without protection on servers.","a. Issue public key certificates under an [Assignment: organization-defined certificate policy] or obtain public key certificates from an approved service provider; and\n  b. Include only approved trust anchors in trust stores or certificate stores managed by the organization.\nDiscussion: Public key infrastructure (PKI) certificates are certificates with visibility external to organizational systems and certificates related to the internal operations of systems, such as application-specific time services. In cryptographic systems with a hierarchical structure, a trust anchor is an authoritative source (i.e., a certificate authority) for which trust is assumed and not derived. A root certificate for a PKI system is an example of a trust anchor. A trust store or certificate store maintains a list of trusted root certificates.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.664+00:00",{"total":9,"list":19},[20,24,28,32,36],{"slug":21,"title":22,"published_at":23},"helpdesk-0-days-exploited-within-hours-as-ai-evading-malware-emerges","Helpdesk 0-Days Exploited Within Hours as AI-Evading Malware Emerges","2026-10-12T18:20:36.878+00:00",{"slug":25,"title":26,"published_at":27},"ad-certificate-services-flaw-enables-full-domain-compromise-via-privilege-escalation","AD Certificate Services Flaw Enables Full Domain Compromise via Privilege Escalation","2026-08-17T16:20:24.698+00:00",{"slug":29,"title":30,"published_at":31},"digicert-breach-exposes-code-signing-certificate-theft-via-spear-phishing-rat","DigiCert Breach Exposes Code-Signing Certificate Theft via Spear-Phishing RAT","2026-07-17T18:21:01.282+00:00",{"slug":33,"title":34,"published_at":35},"apt-group-exploits-legitimate-code-signing-certificates-to-evade-detection","APT Group Exploits Legitimate Code-Signing Certificates to Evade Detection","2026-04-11T11:07:36.605+00:00",{"slug":37,"title":38,"published_at":39},"chrome-deploys-hardware-bound-session-protection-against-cookie-theft","Chrome Deploys Hardware-Bound Session Protection Against Cookie Theft","2026-04-09T20:09:17.133+00:00",[41,46,51,55,60,64],{"slug":42,"name":43,"problem":44,"stories":45},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",4,{"slug":47,"name":48,"problem":49,"stories":50},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":52,"name":53,"problem":54,"stories":50},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":56,"name":57,"problem":58,"stories":59},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":61,"name":62,"problem":63,"stories":59},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":65,"name":66,"problem":67,"stories":59},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[69,74,79,84,89,93,97,101],{"family":70,"item":71,"code":72,"title":73,"together":45},"gdpr","32","Article 32","Security of processing",{"family":75,"item":76,"code":77,"title":77,"together":78},"itil","overview","ITIL",3,{"family":80,"item":81,"code":82,"title":83,"together":78},"nist-sp","800-57","SP 800-57","SP 800-57: Recommendation for Key Management",{"family":85,"item":86,"code":87,"title":88,"together":78},"cis","6","Control 6","Access Control Management",{"family":85,"item":90,"code":91,"title":92,"together":50},"7","Control 7","Continuous Vulnerability Management",{"family":5,"item":94,"code":95,"title":96,"together":50},"ac-6","AC-6","Least Privilege",{"family":85,"item":98,"code":99,"title":100,"together":50},"2","Control 2","Inventory and Control of Software Assets",{"family":85,"item":102,"code":103,"title":104,"together":50},"13","Control 13","Network Monitoring and Defense"]