Webinar Transcript: Common And Risky MS Intune And NDES Misconfigurations and How to Fix Them

Muneer Mubashir:

Start the recording. So here we are with me today. I have Jake grand Leonard. Jake is our senior solutions consultant hereat PKI solutions. Hi Jake.

Jake Grandlienard:

Hi there. How’s everyone doing?

Muneer Mubashir:

Excellent. Glad you could. You could join us today. So before we get into the, to the agenda, I wanted to quickly, as I said, introduce Jake. Jake has been with, with PKI solutions for how long now? Jake?

Jake Grandlienard:

Just past four years.

Muneer Mubashir:

Okay. Okay. And, and Jake, how long have you worked with, with PKIs?

Jake Grandlienard:

I just passed about 20 years.

Muneer Mubashir:

Okay. So, so, and, and Jake, one of the questions I, I always like to ask you is like, how many, how many customers have you worked with over the last 12 months where you’ve focused on PKIs?

Jake Grandlienard:

I mean, pretty much everything. Everything we do is, is PKI. So over the, over the past couple years, especially that pertains to what we’re gonna talk about today, 25-30 PKI, you know, clients going concurrently between support projects, things like that, but then focused on, on Intune and, and end, as, you know, probably close to 10 where some of them were planned projects. Some of them were discovery as part of an assessment to, to realize it was actually there. So quite a bit of, of this and I it’s growing a lot cause it’s, it’s really popular in, in the market right now.

Muneer Mubashir:

Great, great. And this is why we decided to do this. When, when I was talking to, to Jake, I, I, I joined PKI solutions about four months back and I lead marketing and I was like, Jake what’s top of mind, what do you see over? And, and, and he brought up NDES and, and Microsoft, and, and we said, okay, let’s start with some content. And we decided to start with a webinar. I just wanna premise a few things. One, please keep it conversational, send questions, chat, I’m monitoring it so that we can, so Jake is here. He can answer your questions. If you feel you have some sensitive information that you don’t wanna share on, on chat, feel free to, to reach out to us. We have Carolyn Ballo, who’s our client relationship manager. You’ll see her name in the, in the handouts as well.

Muneer Mubashir:

So, so keep it conversational. Let’s keep it, keep it engaging and not just one way chat from, from us. So a little bit about PKI solutions as, as Jake kind of quickly touched upon this PPIs all the time, Mark Cooper, who was one of the original ADCs engineers founded it consulting. And we also about five or six months back released a product called PKI Spotlight that tries to address the visibility and the security configuration issues that companies face don’t wanna spend too much on that. But I want to go move quickly to our first topic, which is giving you an overview of NDES and Microsoft Intune components. And this comes back to the conversation that Jake and I had as we were thinking about this topic. And I said, Jake, why do you wanna start with this overview of the, the Microsoft and, and Indus components? So, so Jake, why should our listeners start with, with that would that quick overview of what makes Microsoft an NDES ecosystem?

Jake Grandlienard:

Just, just because I, so many of the, the products that require certificates and, and whether it be windows based and, and non-windows based certificates are a part of nearly everything we do and, and how we’re getting those certificates out. And, you know, the industry, I, I feel like over the past several years with the different mobile device managers that used to be often and never some, you know, the big players Intune has started to really step into that. And the more Intune has stepped into that space of managing these devices and getting certificates out. It’s putting more and more pressure on making sure that our, our PKI is sound so, and as is, is the conduit to get those certificates to Intune. And then, you know, out to these devices of, of all types that we’re starting to manage now.

Muneer Mubashir:

And, and this is, this is where you have started to talk to, right? The, the different components that make up the flow of, of information from client requests to, to, to search being served,

Jake Grandlienard:

Correct? Yes. Yeah. So I I’d put this together as kind of a high level overview of, of the flow, but the, the, you know, the conversation that we have today is on end as an Intune primarily, but, you know, really we can’t forget about, you know, the PKI and our certificate authorities and how those are configured and, and the base part. So even though I, you know, is how the certificate authority here, you know, the templates and, and all those other things that really come into play here, but you kind of see how, you know, this is what is allowing us the Intune connector to secure the connect Intune to our ends server, which is then IAM gonna, you know, get those requests to the certificate authority, to be signed, and eventually end up back on those devices that we’re managing, whether they be the, the laptops, the windows, iPhone, Android, we can manage just about Intune has really grown and what it will manage and what all it’s being scoped to managed now.

Muneer Mubashir:

And what about the Azure app proxy? So one of the things you talked about was, yes, that’s out of the box, but what if our, you know, listeners don’t have, don’t want to use Azure app proxy, they want to use some other proxy within their environment.

Jake Grandlienard:

Yeah. And that’s, that’s absolutely supported. So I, I, I put this in here just to, to show the, the role, but we have clients that are, are using other devices as a proxy. If they have appliances, they can fill that, that role. They can absolutely do that. Microsoft is not as particular as, as maybe they have been in the past, you know, forcing the use of, of their tools, but we can absolutely use other types of, of proxies to do that. We just wanna basically a secure way to allow those, that flow of information back forward and, and through, so,

Muneer Mubashir:

Okay. Okay. Which brings to, so we’re now starting to get to the, the important topics that we discussed. So what are the top mistakes and misconfigurations that you see our customers make as they’re about to roll out or, or have already rolled out Microsoft and as, and, and with Intune.

Jake Grandlienard:

So a lot of times we’re, we’re coming in to, to build it, but then also a lot of other instances, we we’re coming in after it’s been built and the industry as a whole, when we find out we need certificates, there’s, there’s a lot of third party vendors that make that PKI install really short, slam it in grant everything in the world, access as much as it needs or, or more just to make the, the product go in. And, and I’ve seen that too, with some of the other install, guys, I’ll call them that some other consultancies and, and even, you know, big groups have, have put together. So they’ll come in, they wanna get into a place. So they have to install end as quickly and get it configured. And, and what ends up happening is they leave behind a lot of over permissioned service accounts and, you know, granting, I, I saw one client who told, told me that, yeah, they said the service account has to be a domain admin.

Jake Grandlienard:

So things that are very bad that you, you shouldn’t ever see to. And it doesn’t take that to get it installed if you’re doing it the right way. So we just wanna make sure that we’re, you know, giving the permissions needed and nothing more. And, you know, sometimes I know we have to use credentials. We don’t like to use for the initial configuration, but we wanna go back afterwards and we wanna clean those up. We don’t wanna leave those, you know, on the server and leave things in these groups that they don’t need to be in because it, to, to service, you know, one hole we’re actually opening another in our security posture. If we don’t clean up after ourselves or use a bad install guide,

Muneer Mubashir:

Okay.

Jake Grandlienard:

The, the, the signing certificates, the, the, the default config and Microsoft is, is very restricted when you go through and, and you do your end as configuration, it doesn’t allow you to change anything. It doesn’t allow you to, you know, rename and use custom certificates on the initial install. You have to go through the install, take what it gives you, and then go back later and, and, and fix those. But, but what we see is two, two things here for the signing certificates. These are high value certificates. These are enrollment agent type certificates. So this is really where the revenue meets the road. These are actually what’s being used as that link to get certificates out to non domain, join devices as they’re link back into our active directory. So they don’t have to have an object that it, that it relates to the, these certificates are old, the ones that are utilized.

Jake Grandlienard:

So we we’re limited on what we can do with them. And by staying with the default templates and not doing anything, it, it, it sets us up for failure and it makes it a lot harder to manage those long term. So when it comes time to renew, them Microsoft breaks its own rules here. And one of, one of the two certificates that it puts in the machine stores actually a user certificate. So it makes it hard to operationally, keep that going. Especially if you, if someone lets them expire, then it’s a lot more difficult to, to renew them and get everything working again.

Muneer Mubashir:

Okay.

Jake Grandlienard:

And this is referring more to the, the certificates that, that are gonna be used and the templates that are gonna be used to issue certificates through, to those end users and, and to the, to the, to the client machines or, you know, mobile devices or whatever. So as we do this, a lot of times we don’t have, or a lot of clients, I should say, we come in and they don’t put a, a good a group around who can request these certificates. So all, all of these certificates that we’re issuing to these, these clients are, are what we would consider an offline template, meaning we’re gonna supply the value for the subject in the request. And, and we also are going to be issuing these and have these configured for, for client authentication, which, which sets us up for a bad place where a really large number of group. I see a lot of domain users, authenticated users being granted access to these templates. So then anyone can request these, put anything they want in the certificate template, be anyone, and it, and it can lead us down a, a bad path to credential, or I’m sorry, privilege escalation. So that’s a, this is the, a really big area to, to look at after the fact, I think this is probably one of them that gets skipped over the most.

Jake Grandlienard:

This last one is it’s a little bit, you know, higher level or broader topic, but it it’s happened at a couple different clients. And so if we take a step back from Intune, I was, we were, we were talking yesterday Manier and I about how the Intune and NDES fit together. And I, I kind of explained it as NDES is, is being a fork in the road. So we wanna know what we’re gonna use NDES for, because is some, you know, or a lot of may have found as soon as you apply, or, or you intend to use an end desk server for Intune. It, it no longer works for anything else. So you can no longer get certificates to your appliances. So it’s, it’s it, it serves only one purpose. And, and actually what happens when that we’re not connector is applied, is it completely changed the way NDES functions.

Jake Grandlienard:

So, so some things we don’t need to worry about as much, but if, if we’re taking the other route and, and we’re talking about having our NDES server out there, that is going to be issuing certificates to our lights out type appliances or any type of networking gear, then we need to make sure that the configuration is done another way and, and make sure it’s managed as such. So, you know, going into this, we need to just be aware of what it’s gonna be used. How critical is this, is this infrastructure gonna be? And we’ll talk about that a little bit later on, but J just know our use cases and, and what we’re gonna be using end as for going into the build is gonna get us a lot better result after, after we’re done building it.

Muneer Mubashir:

Excellent. So, Jake, before we get into like the implications of these, I know there are questions that have popped in. I’m gonna wait a little for, to address all of these, but one of the, one of the questions, and, and I wanna put this out there, so you can either address it now or later, is there a way we could configure end certs to be Auto renewed? That was one, if you wanna take that now, or we could do it, you know, later as well, but I wanna put that, put that question there.

Jake Grandlienard:

Yeah, no, I think that’s a, it’s, it’s a great segue. We’re asking another couple of questions out there. So someone brought up a great point, Alex, around the, so some of the limitations, as I said earlier, I always, I always call end as a fickle beast. And, and it really is, and it’s a little antiquated at times. It can only use certain a lot of times, maybe older providers, so a cryptographic service provider versus what would be newer key storage provider. So, and IAM IAM, I’m bringing this up and it all comes in together. Here is when, when we go into to a client and they’ve done the, the base install. So we have to, we have to do that base install, but what we can do is turn around and create new templates to, to be used in, in their place. And then, and then it gives us the ability to set those to, to be Auto renewed.

Jake Grandlienard:

So, so we don’t run that risk of having them expire. But then in that same, by that same token, we have to use, you know, the CSP or the cryptographic service provider. Most of the, all of ’em that I know of HSM vendors support both providers. So that’s also when we’re creating those new templates, that’s also our chance to push those keys over to an HSM. If client, if a client has it. So we can use those new templates to say, Hey, you know, basically we’re gonna say, we’re gonna use, for example, the encipher HSM use the incur certificate provider. And then when those certificates are renewed, those keys are gonna be stored on our HSM. So there’s a lot of different things we can do, you know, to solve the problem of them, not expiring, but also to protect our keys even better for those signing certificates. That’s great question, Alex.

Muneer Mubashir:

Great. Thank you. So, one thing I would recommend is I see some questions being asked in chat. If you could move those questions that you wanna have addressed in the Q and a section, it just becomes easier to, to track. I’m trying to go through the chat as well, but just a little easier because they, they bubble up. So if you could do that, thank you. There’s one more that came, came up, which is around, you know, show examples of certificate template settings that should be customized, increased security. I know you’re getting into tips and tricks towards the end at this point. We’ll kind of hold it for that, for that section. Is that, is, would that be a good way to handle this, Jake?

Jake Grandlienard:

Yeah. That’s that’s that was in, in towards the end. We kind of talk about, you know, that, that very thing.

Muneer Mubashir:

Yeah. Okay. So, so awesome. So let’s get into the, the risks and severity associated with these misconfigurations and I’ll, I’ll be the first one to admit this, you know, I have a long background in, in it, relatively new to the cybersecurity space. And then of this, you look at, you look at certificates. And, and one of the things that I quickly realized is, is Jake. When I looked at the template documentation, right? The definition of template from, from Microsoft itself, that’s a hundred plus pages, right? So you are, you know, or you’re defining these, these configurations that are, that can change with, you know, transposition of digits. There, there are a lot of what I would say, subtle changes that can have an impact on, on the risk profile that can have an impact on operational. And sometimes we don’t fully understand the nuances and the impact of these, of these configurations. So why don’t you walk us through what are, what is the, the implication, right? When you see these mistakes we make, or sometimes we overlook these configurations, what are the implications of, of these, of you know, of these oversights?

Jake Grandlienard:

Right? So as I kind of let let off with is I think what I see at times is, is too much of a focus on, on Intune alone. And, and by, by that, what I mean is, you know, get it in there, make it work, you know, regardless. And, and a lot of the Intune pieces in, in our diagram earlier are, are, are kind of black box. So we, you know, we get a couple radio buttons in the connector, you know, and we can do, you know, some other things, but a lot of it is, you know, in our profiles and whatnot, but a lot of it is black box. So we’re not gonna be able to, you know, change that much or, or hopefully not need to, but for the, everything that Intune is in our case here, residing on and looking or built on top of which is our end desk server, our, our, you know, our PKI in general. So making sure that we’re sound, you know, all the way through, and, you know, we say garbage in garbage out, or in this case, you know, just if it’s shiny on the top, if Intune is working, that doesn’t necessarily mean we have a healthy relationship and, you know, and we’ve added a, a secure way to get those certificates out or, or didn’t create a whole by, by doing that. So that, that’s what I was kind of referencing there was make, make sure we’re looking at this holistically and not just Intune working.

Muneer Mubashir:

Okay. Okay. I know there were some questions about if you only are using Intune where I’m gonna hold on those come, come to them a little later, but this kind of ties back to what, what you mentioned. And this is, this is kind of more aligned with also some of the questions that are coming in from the, from the audience. And, and let’s say, you know, if one of the questions came from George is like, if you, if you only use Intune, is it safe to use the Intune end as connector application updated regularly? Of course, right? If you, if, if it’s only an Intune use case and is it safe to use the Intune end as connector? I hope I hope that question, you know, makes sense.

Jake Grandlienard:

No, yeah. That, that, and that’s, and that’s a valid question. So, and I, and I saw that one in there and it’s a good one because NDES, like I said earlier, can be fickle and you can actually bypass NDES with the, intune connector if, if you’re using the PFX portion of it. And, and really, so Intune is kind of new to the space of, of doing the PFX. And, and for anyone who doesn’t know, when we say PFX, we’re basically talking about the private key is out, meaning it’s being moved around the private key. So it, it kind of lends itself more to how a lot of the older, well, there, they’re still out there, but when the configurations in the past, when I would work with, with AirWatch, which I know has a different name, and I apologize something, one management, one anyway, mobile, iron, all, all those, all, all of the others, they, they would do a lot of the PFX moving around.

Jake Grandlienard:

So where it really comes down to is they’re not generating that certificate on the device, which so the certificate and, and private key is being generated off the device and sent to them. One of the things in, in PKI in general, we try to avoid is moving our private keys around. So, you know, so it, it absolutely, you don’t have to have end as if, if you’re using that PFX option. But mark and I were, were talking about this the other day, that one of the things he always really liked about end as an Intune, that integration is he, he called it doing it the right way, but the key is being generated on the device. And then we are signing that request versus something else, generating the request, sending the private key, you know, along the way to be installed on, on that. So that’s really the device. We don’t have to have end death to issue those certificates and use Intune, but we’re just taken into account that when we do that, we’re allowing our private keys to be moved around that PFX our, our files, our, our being generated off the device.

Muneer Mubashir:

Got it. So, in, in a, in a nutshell, you, the recommended is to use Intune with NDES as opposed to, without it

Jake Grandlienard:

Yeah. If it, if it’s possible and I, I’m not gonna say every scenario fits here yeah. You know, with NDES, but it, it is always better to generate the key on a device and not move it around. So that’s, that’s kind of why our NDES comes in is that that’s what facilitates us to, to do this.

Muneer Mubashir:

Awesome. Awesome. Okay. I know this is, this is stop of mind for you as well. You’ve, you’ve mentioned this to me a few times. Love to love to hear what you have to say about this.

Jake Grandlienard:

Yeah. This is probably the, the biggest issue that, that I get for all the clients that, that we support reaching out in questions. And, you know, it, it seems simple enough, you know, the science certificate expires, but not, not to take away anyone’s fault or blame here, but Microsoft, the installer, I should say for, for end as when we’re going through and it Auto generates those initial search and it works. We’re not always is aware of those. So a lot of times what will happen is, is they will expire. And, and when they expire, everything comes down. No, we’re no longer issuing certificates. If we’re counting on Intune to issue certificates that, you know, that’s gonna stop. If we’re end as alone, not using Intune, that’s, that’s going to stop. So, and, and, and to complicate things. And I touched on it earlier, Microsoft broke kind of its own rules in, in here.

Jake Grandlienard:

And, and everyone that has ever worked with certificates knows there’s a very distinct line between user and, and computer certificates. Doesn’t matter if you have permission to enroll for a computer certificate as a user, it’s, it’s not gonna make itself available to you. Now, obviously we can force anything, but, but going down the normal path. And, and so we have a, a user certificate in the machine store and it makes it really hard to, to renew that if it does expire. So keeping an eye on those, it’s one of the things and, and, and why in our coming release of PKA spotlight, this is something we’re monitoring now, because this is what breaks a lot of time for a lot of clients. So letting those signing certificates expire is, is a huge issue. That, and it it’s widespread.

Muneer Mubashir:

Awesome. I’m gonna move things along a little here. We have, I would say about 15 minutes to go. So Jake, yeah. Let’s go through the others and I’ll, I’ll hold the questions till, till we get to the tips and ticks section.

Jake Grandlienard:

Okay. Sure. So I, I, I started to touch on earlier the certificates that we’re issuing to the, to the clients. So those are the three certificate values we set in the registry. Well, when we’re configuring end, as those templates in, in an active directory, or, you know, issued from our, from our CA we’ve had multiple clients recently reach out after having issues with penetration tests. And it always seems to be the templates that were originally configured for NDES, where people are having trouble, where it, the certificate is supply and request the group is, is, is way too large authenticated user domain user. You know, everyone in the world can request a certificate. And, and then we end up with that, the privilege escalation. So this is an area that, that were especially focused on right now, just, you know, trying to make sure that we eliminate those gaps and, and try to, you know, draw attention to any type of template configured that way. But this is one that falls into that category. And it’s, it’s, it’s a, it’s a big thing.

Jake Grandlienard:

And then the, the, the last one of, of these is a single point of failure. So NDES has a, and I think someone already mentioned it in, in the chat and it’s absolutely true. NDES can only point at one CA at a time, meaning if, if something happens to that CA it becomes a single point of failure, but we can actually point multiple NDES servers at a single CA and with, within Intune, we can also have multiple NDES servers to, to act as that redundancy there. So if we have multiple CAS, we can, we can issue those certificates that that will be trusted. So, you know, just, just keep in mind that, you know, EZ cannot point it more than one CA a time. So if we have to migrate or do anything like that, it becomes a single point of failure. And through the, you know, the past couple years in the pandemic, it’s become increasingly clear that we are heavily, heavily reliant on getting certificates out to those devices. And if, if we lose that capability, then it, it, it causes a lot, a lot more problems than I would say, even five years ago in most environments.

Muneer Mubashir:

I know Jake, you’re gonna talk about, about some eliminating single points of failure as well. I think you briefly touched on this. So one of the things I would love for us to, towards as you’re covering the single points of failure point, also maybe give some tips on how to build high availability into end, as I think you, you mentioned some of the limitations, but what is, what, what our, our, our listeners should be able to do to, to ensure some, some high availability there. So, so with that, I’ll go into the tips, like, what do you recommend that we do?

Jake Grandlienard:

So, first thing that that we’ll do is, and, and some people when, when I’m working with them doing an assessment, or we’re working, even on another project, you see the telltale signs of the default certificate templates published on a CA then, you know, either end as is there, or, or at least it was there at some point. So from there, as soon as I see that, or someone says they have NDES environment, I, I like to go through and, and basically just look at the big ones, you know, there, there are multiple ways to run NDES. We can run it with a service account, we can run it with a group manage service account, you know, so there’s a lot of different configurations there’s. And then I, I just like to go through and, and look at those, make sure that, that if, if we’re using a service count, it wasn’t left in a really privileged group, domain admin, or, or something like that, which like I said, I did find, you know, make sure that it has the access it needs and, and that’s all. So we just wanna make sure that the configuration that that was done is what, what needed to happen. And, and we’re not leaving behind things that could come back to buy us later. If it, if it’s a service account is a password gonna expire. So there there’s a lot of different things. We just wanna keep an eye on service, principal names, all of these things. I, I like to look and review after the config is done, just to make sure it’s, it’s where we want it to be.

Jake Grandlienard:

And, and this is something we we’ve touched on multiple times now move away from the original signing certificates. And we do this by, you know, simply duplicating the templates and, and renewing and enrolling for those. So move off those default templates. And, and with that, we get the ability then to set them up for Auto Auto renew or Auto enroll, which is basically Auto renew, if we already have the certificate. So yeah, we wanna move away from those and, and reduce our risk of, of having those expire and bringing everything down.

Speaker: 2

Okay.

Jake Grandlienard:

This, this has been one of the biggest things going through here is keep an eye on the, the template permissions. If, if your environment is, is one in, in very, very seldom, do I work with a client who it was their choice initially, to be in PKI? I myself 20 years ago stepped into the role because someone was going out on fraternity leave and I’ve, and I’m still here. So, so where I’m going with this is more than, more than just the PKI. People sometimes have access to those templates, make sure permissions haven’t been added, make sure that our, our templates that are configured to be issued to our end clients have the correct extensions. If we don’t need encryption, don’t put encryption in it, you know, if it does fine, but just make sure that not only that, you know, are the right people having access to those templates, that, that we’re going to be issuing out and trying to avoid that privilege or that issue with supply and request and client off. So we, we want to keep track of those, but, you know, just make sure that our templates are staying as they are. And, you know, I know there are a lot of tools out there that clients have spotlight is, has this. So we’ll know if a change has been made in, in ad to our, our templates. Other things pick that up as well, since they are changes to active directory, but keep track of those templates that are set in the registry on the end dev server, because they are very important.

Jake Grandlienard:

And this is just kind of a, you know, an overview of all the different things that people reach out to us for. So be prepared for the issues it’s way, way easier to renew a end as signing certificate than it is to go after it’s expired. I mean, considerably easier. And that’s, if you’re working with the default temp, at least when, when we do renew those, it, it can be a simple renew it. If it, if it expires, then we’re gonna have to, you know, go down different path. A lot of times possibly create new templates, a CA migration for. So when I mentioned earlier that single point of failure end as points at one CA 2012 R two server, 2012, a lot of clients are working to get those outta their environments. And, and a lot of PKIs were built on that operating system.

Jake Grandlienard:

So when we start to migrate to a newer operating system, whether we’re migrating our CA we need to repoint our end desk server to that new CA if you’re doing a, a root renewal for your root CA currently that impacts everything because that’s the base of your profile that you’re pushing out, you’re gonna be pushing new profiles out to everything. So just, just trying to eliminate these things ahead of time, you know, be prepared for when that happens, know what it’s gonna be. And then, you know, lastly, that single point of failure, like Manir had mentioned earlier, NDES is what it is, right. It can only point to one CA so, but we could have multiple NDES servers pointing to the same. CA if, if you have multiple CAS, you could have, you know, NDES servers pointing at different CAS. So, you know, the loss of a single CA wouldn’t necessarily bring us down. So these are all things to, you know, keep in mind to, to make up for the fact, you know, the NDES can’t be, you know, more flexible or dynamic in that, where we have that, you know, connection to that single CA

Muneer Mubashir:

Great, great. I know we have about four minutes left, so there’s, there, there are questions we won’t be able to, to get to, but the, the plan here is we will address these questions either in the, in the written form as a, as a follow up. And so just wanna say that these questions will, will get through them. There’s one. I wanna see if we can, if there’s a question we can do within, you know, within a minute, Jake, is there anything that you wanna take that you can quickly get through? You know, is it, you know, end as Intune versus se configurations? Is there anything you wanna quickly take before we move to the, to the wrap up here?

Jake Grandlienard:

No, I guess the thing I would say is this is definitely one way to accomplish this goal. You know, step protocol is supported. Some of the certificate of lifecycle managers also can basically do like a virtual step. So maybe not as, as straightforward or easy to configure, but it definitely could be an option for clients. So the it’s not definitely not the only way to do it, but NDES is, is a, is a role on the CA so we get a lot of this. And if, if we’re going to go this route, I’m not saying this is the only route. If we’re gonna go this route, we wanna do it the best we can do it. It, and we wanna make itt he most secure, you know, way to do it. So we’re protecting our, our clients and, you know, we’re not introducing risk when we’re trying to solve it.

Muneer Mubashir:

Okay, awesome. As I said, we will, as a, as a follow up to this webinar, we’ll go through the questions and address them. And you’ll, you’ll have them in, in, in written form as well. So that’s one of the things we wanna do as we, as we do these webinars, because there are lots of questions. And Jake, when, when we set up, Jake had mentioned like, there’s a lot to cover IAM, wanna stay high level. Otherwise we could be here for the entire day going through, you know, going, going through things. So, so again, I love the feedback about these sessions need to be an hour that came in through the chat. Again, we’re just a little sensitive of, of the time wanted to keep it to 45 minutes. But if that’s something that the audience wants, would love to do extended the next one to, to the hour.

Muneer Mubashir:

So one of the things I do want to quickly, you know, talk about is, is how can PKI solutions help a little bit of two things, as I said, what we are consistently saying, and, and, and Jake touched upon, this is sometimes folks accidentally run into managing PKI. Someone went on on maternity leave, or someone went on, on, on vacation. So as, as a way to address two important needs today, what we’re doing is we’re offering a special, a 40 block hour more, you get two online training courses from PKI solutions, including the, the latest one, you know, introduction to certificates and keys. So if you have a backup within your organization and we want to increase the PKI knowledge, that’s a, that’s a great option. So Carolyn Ballo who’s our client relationship manager is, is available. The contact is here and we will make the deck available as a, as a follow up.

Muneer Mubashir:

So the other thing that we have is some of the next webinars we plan. One is around PKI spotlight. What’s new, it’s a quarterly update. And as Jake mentioned, we are investing in capabilities that just make it easier to keep track of configurations. And that includes end as, and Intune, and in our next release, which is slated for, you know, early part of the next month, you could, you will also have best practices where you’re continuously monitoring for certificate expirations, and so on and so forth. I don’t wanna steal the thunder from, from Nick, who’s our program manager on it, but, but feel that it’s time to automate a lot of these functions and, and that’s where we’re, you know, investing some time. And then we also have a follow up on how do you effectively convey the business value and justify investment in PKIs.

Muneer Mubashir:

We do believe PKIs are critical to the, to the business, but at the same time, there isn’t a maturity model, a business justification model that exists. That’s purely focused on PKIs and we are, you know, we’re running and, and, and building those. And these are the two webinars that we have coming for for next month. So that pretty much captures the, what we had for, for today. I wanna leave you with, please send your feedback questions to what we can do better on these, and including if there are topics from this webinar that we would, that you would like to see us go more in depth into feel free to, to send us these, these recommendations, because that’s what we wanna do. We wanna make it worth here, worth your time. So that pretty much captures the, or rather ends the, the webinar for today and look forward to another one. And, and we will plan on having these for an hour instead of, of 45 minutes. Thank you. And hope to see you guys again. Thank you