¿Por qué las organizaciones deben preocuparse por la gestión de identidades de máquinas?

Machine Identity Management (MIM) is an essential component of an organization’s cybersecurity program. Machine identities come in the form of cryptographic keys and digital certificates that are used to identify and securely connect virtually everything in an organization’s network – workloads, services, devices, and more. Today’s modern enterprises rely on thousands of devices and applications to conduct day-to-day operations. Similar to the humans that make up an organization, each device needs its own identity, and security teams must properly manage and secure it. 

The major challenge with properly managing machine identities is that the lifespan of trusted certificates is only 13 months. Understandably, many IT teams don’t have the time or resources to track hundreds of thousands of certificates across an organization. However, when machine identities aren’t treated as critical infrastructure to the security of an organization, those organizations face the risk of outages. And in some cases, outages can cause irrefutable damage —not just to the business but to its brand reputation.

Yet many organizations are just catching on to the essential need for machine identity management. But why are companies starting to care more? And is your organization where it needs to be – before it’s too late?

In an episode of the EM360 Podcast, Editor Matt Harris spoke with Chris Hickman, Chief Security Officer at Keyfactor, about why companies are paying more attention to machine identity and the trends organizations need to capitalize on now to prepare for the future. Here are some of the insightful points from their discussion.

¿Por qué cree que más empresas se están centrando en la identidad de máquinas?

Chris Hickman: Most organizations have spent a lot of time and effort on streamlining their human identities. But now that they understand who people are, how they interact with each other, and how they securely authenticate, the time has come to start looking at doing that same approach with machines. 

Several initiatives, such as zero trust and moving to the cloud, are accelerating organizations’ need for machine identity management. Organizations are developing a stronger understanding of the security of the devices they are using, the communications between these devices, and the frontend and backend systems associated with them. They are realizing that machine identity can be effective, efficient, and agile from a lifecycle and incident management standpoint. 

¿Qué cambios están modificando la forma en que las organizaciones gestionan la identidad de máquinas?

Chris: Machine identity has come to the forefront because organizations are starting to consolidate the various teams that manage identity. For instance, PKI and X.509 certificates were traditionally the domain of a particular security group. But increasingly, we’re seeing the responsibilities for the issuance of the certificates falling under the identity management team. This shift to consolidation is driving the notion that identity is not just about security, and it’s causing companies to consider how they holistically manage identity within the business.

¿Cuáles son algunos de los desafíos que las empresas intentan abordar en relación con la escalabilidad de su estado de gestión de identidades?

Chris: The commonality we’re seeing is that there is very little understanding of where credentials and identities live within an enterprise, so they can’t figure out how big the problem is. Organizations are struggling to answer questions like:

• ¿Cuántos certificados tengo en mi empresa?
• How many SSH keys do I have?
• ¿Dónde residen los certificados? 
• ¿Para qué se utilizan?
• ¿Desde dónde se emiten?
• ¿Los certificados cumplen con el estándar actual? 
• ¿Tienen un protocolo de gestión del ciclo de vida adecuado asociado a ellos?

The answers to these questions compound as an organization continues to scale and more certificates are used. According to Keyfactor’s annual State of Machine Identity Management report, 70% of organizations say the growth of keys and certificates has increased operational burden. Enterprises are turning to automation to help ease this burden so they can keep growing their business.

¿Qué medidas toma Keyfactor para resolver los problemas de identidad de máquinas de las organizaciones?

Chris: We start with a complete inventory of an organization to get visibility of the foundation of the machine identity problem. Then we look at assigning ownership, creating cross-functional groups, and defining who owns the credentials, because a single credential may have multiple owners. For example, there may be a credential that represents a web server, but on that web server is also an application. If the server goes down, then the application will be down. So, the ownership may be spread across multiple different teams. 

A continuación, adaptamos las políticas y prácticas a la nueva estructura para que esta mentalidad forme parte de la cultura arraigada. Por último, pero no menos importante, está la automatización. Porque una vez que se implementa la automatización y no se renuevan ni despliegan credenciales manualmente, se coloca a la organización en una posición mucho mejor para escalar y mantener la seguridad del negocio.

¿Qué tendencias deberían considerar las empresas ahora para prepararse para el futuro de la identidad de máquinas?

Chris: There are several things afoot right now, particularly with the evolution of quantum computing and the maturing of cryptographic standards. Quantum computing is becoming a reality to the point where it could break existing cryptographic algorithms. This quantum threat is still evolving, but it will soon require organizations to change how machine identities are derived using cryptography. The potential risk is driving a change to cryptographic standards and protocols that organizations must start preparing for now. Otherwise, they will be at a disadvantage and open to significant security risks.

¿Tiene más preguntas sobre la identidad de máquinas y lo que significa para su organización?

More than one-thousand companies trust Keyfactor to issue, manage, and protect machine identities across their business. The Keyfactor platform is built to solve your present and future machine identity needs with integrated PKI, digital signing, and machine identity management.

Contáctenos hoy para obtener más información.