Ditch Secrets for Identity-Native Infrastructure Access
For security benefits and operational efficiency, teams are “shifting left” for cloud and cloud native infrastructure operations. But the access management practices are still stuck in the past with passwords, shared secrets and manual workflows. Most of the patterns we see in infrastructure attacks are the same — first, adversaries exploit human weakness to get a foothold inside corporate assets. Then they pivot and exploit further until they complete their objectives. And along with these actions, the core culprit is always a stolen credential.
It’s time to move away from secrets and static credentials that are easier to compromise and have a long-lasting impact. It’s time to treat machine and bot access similar to user access. It’s time to integrate access control systems well with the tools and workflows of engineers without affecting their productivity. It’s time to “shift left” for infrastructure access management. That’s where we are introducing a modern, identity-native way to manage infrastructure access.
What Is Identity-Native Infrastructure Access?
Identity-native access is a secretless and zero trust access to infrastructure resources. An identity-native system natively integrates with all modern infrastructure management workflows, helping teams move away from secrets and network perimeter to identity-based zero trust infrastructure access without sacrificing operational productivity.
Unlike traditional privileged access management (PAM) techniques that are only applicable to administrative access to a set of “critical server zones,” identity-native access integrates into engineers’ workflow, supporting any protocol, any server and any use case in infrastructure operations.
So what makes an access control system an identity-native system? Below are the four core components:
- Identity-based: Access based on the true identity of users and machines (managed as a digital certificate like X.509) instead of secret-based credentials such as passwords, keys and API tokens. And this should be applied to both the human user and machine access.
- Identity aware: Visibility of identity in every protocol access ( HTTP, SSH, Database, etc.) as well as for each pillar of access — connectivity, authentication, authorization and audit.
- Ephemeral credentials: No matter how carefully identity validation is performed, the risks will be similar to passwords if the credential can be used in perpetuity. Credentials should have short lives and gracefully expire after allocated time-to-live (TTL).
- Scalability: Supports all modern operational workflows, such as Infrastructure as Code, ChatOps and CI/CD pipelines, as well as tools and protocols without affecting resource scalability and operational productivity.
Benefits of Adopting Identity-Native Access
Zero Trust Access — Building Perimeter Around Identity Instead of Network
Identity-native access treats true identity as an integral part of access. It involves identity-proofing based on real-world properties. For example, identity proofing should involve our biometric traits that can be used to derive a public-key credential, which can be subsequently used to identify our true identity. The public-key credential, usually a digital certificate, can be traced back to a true identity attested by a certifying entity such as the Certificate Authority (CA).
This allows for building a perimeter around user and device identity that can be securely authenticated and authorized regardless of the request’s origin.
Secretless — Moving Away from Secrets to Public-Key Credentials for Authentication
Public-key credentials enable authentication based on cryptographic challenges. The private key never leaves the client machine, eliminating the risks associated with crackability, guessability and phishing.
Though everyone agrees that passwords are an insecure form of credential, in practice, they “just work.” The alternatives have not been historically easy to implement. Both the access management system and the end protocol or service need to support the passwordless authentication exchange, which is challenging, especially if you are not operating with resources at FAANG scale. But this changes with identity-native systems as support for public-key credentials and digital certificates are the core functionality of identity-native systems.
Frictionless Developer Experience — Improving Engineers’ Workflow and Productivity
Infrastructure as Code, SSH, Kubernetes, Web API, CI/CD pipelines — anything that’s practiced in modern infrastructure tooling and workflow is natively supported by identity-native access. No more working with half-baked tools and stitching different ones that work in silos, which affects productivity.
Single Source of Truth — Uniform Access Layer for Everyone to Every Resource
This single layer builds on the widely adopted privileged access management techniques that is not only applicable to administrative access to a set of “critical server zones” but also is silently integrated into engineers’ workflow, supporting any protocol, any server and any use case in infrastructure operations.
Reducing Impact of Stolen Credentials
With ephemeral credentials and session management, the risk of stolen credentials is reduced as the credential will auto-expire after the allocated time-to-live (TTL) value.
Scaling Access
A unified access layer, meaning a single access management system for every protocol and any service in infrastructure for any use case (developers’ access to database, CI/CD bot, etc.), lets teams scale access to any team size and within or beyond a single cloud provider.
A unified access layer also means the teams should learn access workflow once and use it to access any service inside the infrastructure.
PAM, SSO, ZSP, JIT – It All Comes as a Package
All the security controls such as privileged access management (PAM), role-based access control (RBAC), zero standing privilege (ZSP), just-in-time access (JIT) and single sign-on (SSO) come as a default package in identity-native access.
Time to Move away from Secrets and Network Perimeter to Identity-Native Access
Access control systems are one of the delicate components of cloud and cloud native infrastructure operations. They should be secure enough to those who need access and thwart those that don’t. At the same time, they should be agile enough to adapt to an engineer’s workflow. After all, security is pointless if the cost of affecting an engineer’s productivity is higher than that of the assumed security impact.
Get early access to our book “Identity-Native Infrastructure Access Management” to learn more about getting started.
