The situation
A multinational technology company was investigated following allegations that a private key from a server certificate had been publicly shared. A government department believed the technology company was responsible for the disclosure and had prepared its own forensic report on the matter. The stakes were significant for both parties.
Details in this case study have been altered to protect client confidentiality. The core facts, forensic methodology, and outcomes are accurate.
What we found
NDF’s investigation revealed that a key employee had protected the private key with a strong password. Our analysis determined that cracking this password would require computational resources costing millions of dollars, effectively rendering the key secure despite its alleged exposure. The protection measures applied were consistent with industry standards, including those set out in the ACSC Information Security Manual (ISM).
How we responded
We conducted a thorough investigation that included:
- Technical personnel interviews to establish the chain of custody and protection measures applied to the key
- Digital evidence collection from relevant systems and infrastructure
- Standards analysis against the ACSC ISM and other applicable frameworks to assess whether the company’s security practices met the required benchmarks
- Forensic report review, examining the government department’s own forensic report and identifying areas where its conclusions could be challenged
NDF prepared a formal Expert’s Report addressing each of the concerns raised in the government’s forensic report.
The outcome
The Expert’s Report provided the technology company with an evidence-based defence against the allegations. By demonstrating the strength of the password protection and the alignment with recognised security standards, NDF’s findings materially supported the company’s position that the private key had not been negligently disclosed.
Lessons for similar organisations
- Strong key protection is your first line of defence. Password-protecting cryptographic material to a standard that is computationally infeasible to crack transforms a potential breach into a non-event.
- Expert evidence can counter forensic reports. A government forensic report is not the final word. An independent expert review can identify weaknesses in methodology or conclusions.
- Standards compliance matters. Demonstrating alignment with frameworks like the ACSC ISM provides an objective benchmark against which allegations can be assessed.