Certificate vulnerabilities

cancel
Showing results for 
Search instead for 
Did you mean: 

Certificate vulnerabilities

L0 Member

I have found several of my network devices are showing up within our vulnerability management scanner with X.509 Certificate Subject CN does not match the entity name as a vulnerability. This is more than likely a DNS issue as I do not have any network devices with DNS records. I have been told conflicting opinions and would like to know how do I find the best practices on this finding. Which one would be the most accurate process that I should follow: 

  1. It is best practice not to place DNS records on my network devices as it will make them unrecognizable on the public-facing side. Therefore, security by obscurity. 
  2. Attempt to place DNS records as this secures all devices and allows for security teams to identify and ensure that these devices are behaving as needed through the SIEM. 

 

2 REPLIES 2

Cyber Elite
Cyber Elite

Hello,

This can be several things or steps to remediate. Yes you should at least be running PKI certs from your internal cert authority, AD is great for this. Also the device that is performing the scans need to have those PKI root certs imported so that it can validate the internal PKI you are using.

 

Hope I got the question interpreted correctly.

 

Cheers!

L0 Member
Vulnerabilities in SSL Certificate is a Self Signed is a Medium risk vulnerability that is also high frequency and high visibility. This is the most severe combination of security factors that exists and it is extremely important to find it on your network and fix it as soon as possible.
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!