An SBOM – abbreviated as software bill of materials, is a list of all the software components that collectively make up a particular software product. OS’s, libraries, firmware, drivers, licenses, and other things are listed in an SBOM. An SBOM is often referred to as a software’s “ingredients list” or…
When protecting their web presence, most individuals need clarification on the difference between SSL and code signing certificates and wonder if they can be used interchangeably. The answer is NO. Although both code signing and SSL/TLS certificates use public-key encryption, there are notable differences between the two. The critical difference…
As of May 14, 2023, new requirements for Code Signing certificates have been introduced, impacting how organizations obtain and use these essential tools. This article sheds light on the changes, focusing on certificates purchased after the earlier date. Updated Code Signing Certificate Installation: The recent updates mandate that Code Signing…
A paramount concern for both developers and users is the authentication of software. Code signing is crucial to establishing trust and confidence in software entities such as files, documents, executables, and software. By affixing a digital signature, code signing guarantees the genuineness of the software and safeguards against any unauthorized…
When cybersecurity is at stake, the expiration of a code signing certificate can cast a shadow of uncertainty over any organization. You still need to renew your certificate, and suddenly you find yourself among the 81% of organizations who have faced the same predicament within the past 24 months, as…
Background Baseline Requirements (BRs) for granting CodeSigning Certificates have been updated, according to the Certificate Authority/Browser (CA/B) Forum. For both Standard and EV CodeSigning Certificates, a private key must be created and secured in a FIPS 140-2 Level 2 or Common Criteria EAL 4+ compliant device effective on June 1,…
The following procedure will demonstrate how to generate a Code Signing Certificate request using a key generated and stored in the YubiHSM 2 using the Key Storage Provider (KSP). You can use the Microsoft “signtool tool” to digitally certify Windows binaries with this code signing certificate. Let’s take a closer…
Every organization is responsible for securing highly sensitive information under all circumstances. Developers created standards, regulations, and best practices to enhance data security and expedite this process. One of these standards is the Federal Information Protection Standard or FIPS. The National Institute of Science and Technology (NIST) developed these standards…
To prevent unauthorized access to federated resources, federation servers will enforce the use of token-signing certificates, effectively thwarting cybercriminals from tampering with or forging security tokens. The most crucial validation technique for any federated collaboration is the private/public key pairing utilized with token-signing certificates. These encryption keys verify that a…
The YubiKey FIPS 140-2 Token is a hardware-based authentication device that is used to protect user accounts. The device is compact enough to fit in your purse or wallet. It enables users to generate cryptographic keys (On the device, a randomly generated private and public key pair is created and…
Your code signing certificate could be kept secure and protected from hackers with the use of a YubiKey FIPS-compliant USB Token. Assuming you have a signing certificate in a .pfx format issued by a trustworthy certified certificate authority like Certera, Sectigo, or Comodo. Let’s have a look at how to use Yubikey…
Loading...
