What to make of the machine identity crisis?

Every machine needs a unique identity in order to authenticate itself and communicate securely with other machines. This requirement is radically changing the definition of machines—from traditional physical devices, like laptops and servers, to virtual machines, containers, microservices, IoT devices and AI algorithms.

Wednesday, 26th February 2020 Posted 4 years ago in by Phil Alsop

According to Kevin Bocek, vice president of security strategy and threat intelligence for machine identity protection leader Venafi, all of these device types have been critical to innovation and digital transformation—yet little is done to safeguard their identities.

“While the number of machines in the cloud, hybrid infrastructure and enterprise networks is exploding, most organizations are still attempting to protect machine identities using human methods like spreadsheets,” said Bocek. “However, this approach creates its own set of problems—businesses can’t keep up with the changes in volume and are being exposed to unacceptable risks.”

Secure, reliable authentication is essential to protect machine-to-machine communication yet protecting every machine identity across an enterprise can be a challenge. But, if machines are not adequately protected, the results can have structural and economic damage. According to a report from AIR Worldwide, between $51 billion to $72 billion in losses to the worldwide economy could be eliminated through the proper management and protection of machine identities.

According to Bocek, these five major trends are contributing to the complexity and explosive growth of machines, which in turn are creating a Machine Identity Crisis:

DevOps Engineering
The business imperatives that drove widespread cloud adoption—speed, agility, efficiency and economies of scale—are also the driving forces behind DevOps. These initiatives build an agile, interdependent relationship between software development and IT operations teams. However, the containers and microservices used in these projects often need to communicate securely with one another and the network. As a result, organizations need a technical solution designed to help them protect the barrage of new DevOps machine identities. Open APIs add to the complexity of these projects, which underlines the need for each machine to have its own unique identity.

Cloud Computing

In the cloud, machines automatically create, configure and destroy other machines in response to business demand. In order to protect the security and privacy of cloud data, businesses must encrypt cloud workload data and adequately secure the machine identities that control communication between machines. This includes machines in the cloud and across the enterprise. The rapid deployment change and revocation of the identities for cloud-based machines exponentially increase the challenge of keeping communication within the cloud, and between clouds, secure and private.

Automation and AI

One of the major characteristics of digital transformation has been the growth in automation, and in particular, autonomous machines. Automation has delivered efficiency gains across every industry, further augmented by the introduction of Robotic Process Automation (RPA) and Intelligent RPA and underpinned by Artificial Intelligence (AI). It is essential to the growth of these markets to maintain the integrity and security of input to these algorithms. Because machines need to communicate securely, it is important that communications are not be manipulated in any way that could change the outcomes.

The Internet of Things (IoT)
Many businesses rely on IoT devices, so their use within enterprises is exploding. Each of these machines relies on keys and certificates for authentication and security. Unfortunately, many IoT devices focus on functionality over security, so there are numerous challenges and concerns that revolve around the security of IoT and smart devices. For example, a certificate-related outage or cyberattack could result in widespread business disruption.

Mobility
Organizations face escalating pressure to uniquely identify and authenticate every mobile device so they can authorize secure communication between these devices, enterprise networks and the internet. Although smart mobile devices on enterprise networks have been a fact of life for over a decade, securing and protecting the sensitive corporate data that flows through these devices is becoming more challenging. Unfortunately, most organizations do not have the tools necessary to accomplish this.

Bocek added: “Organizations can only solve these problems with intelligent automation, and they must have complete visibility into every machine identity in the cloud, microservice, IoT network, mobile device and enterprise network. In addition, businesses need to monitor these identities in real time to detect misuse, misconfiguration and errors, as well as automatically remediate vulnerabilities discovered at machine speed and scale. DevOps and cloud engineering teams need to be given the speed of automation, and security teams must focus on safety.”