Machine Identities: As Inter-Machine Communication Proliferates, so Does Security Complexity

Security teams often focus on user passwords, credentials, and permissions. It may be easy to overlook, but an equally or even more important security concern is the interconnection and communication between networked devices. Machines and processes also have access to many of the resources and applications on a network, and the interactions are typically performed with no human intervention.

When machines initiate communications with other machines, they need to authenticate their interactions, just like humans do when logging into a VPN, server, or application to gain access. Gartner and other analysts have begun using the term ‘machine identify’ to refer to a digital credential that uniquely identifies the machine to establish trust and enable authentication.

While the number of active users remains fairly constant, there has been a proliferation in the number of machine identities. Managing machine identities is particularly important in environments that use automation and IoT.

Kevin Bocek, vice president of security strategy and threat intelligence at Venafi, said that “we have seen machine use skyrocket in organizations over the last five years, but many businesses still focus their security controls primarily on human identity management. Accelerated digital transformation initiatives are in jeopardy because attackers are able to exploit wide gaps in machine identity management strategies.”

Jeff Hudson, Venafi CEO, said that “the firewall model of security has been obliterated. Each new technology, from cloud migration to DevOps processes, was already pushing enterprise networks beyond the traditional perimeter. After the pandemic hit and everyone started working remotely, it became absolutely clear that there is no such thing as a network perimeter. The world we’re living in today has machines everywhere, and very few organizations have made the investment required to manage these identities effectively. Implementing a ‘zero trust’ strategy to stop attackers has to begin with strong machine identity management.”

Samantha Mabey, product marketing director at Entrust, commented on Security Boulevard that “for machine identity management, it’s imperative to have total visibility into what’s in your environment and from different sources, centralized policy enforcement, control and monitoring – all from a single pane of glass. The other key to success – automation, automation, automation. Manual crypto and certificate management are no longer sustainable at this scale.”