Pourquoi les organisations doivent-elles se préoccuper de la gestion de l'identité des machines ?

Machine Identity Management (MIM) is an essential component of an organization’s cybersecurity program. Machine identities come in the form of cryptographic keys and digital certificates that are used to identify and securely connect virtually everything in an organization’s network – workloads, services, devices, and more. Today’s modern enterprises rely on thousands of devices and applications to conduct day-to-day operations. Similar to the humans that make up an organization, each device needs its own identity, and security teams must properly manage and secure it. 

The major challenge with properly managing machine identities is that the lifespan of trusted certificates is only 13 months. Understandably, many IT teams don’t have the time or resources to track hundreds of thousands of certificates across an organization. However, when machine identities aren’t treated as critical infrastructure to the security of an organization, those organizations face the risk of outages. And in some cases, outages can cause irrefutable damage —not just to the business but to its brand reputation.

Yet many organizations are just catching on to the essential need for machine identity management. But why are companies starting to care more? And is your organization where it needs to be – before it’s too late?

In an episode of the EM360 Podcast, Editor Matt Harris spoke with Chris Hickman, Chief Security Officer at Keyfactor, about why companies are paying more attention to machine identity and the trends organizations need to capitalize on now to prepare for the future. Here are some of the insightful points from their discussion.

Pourquoi pensez-vous que de plus en plus d'entreprises se concentrent sur l'identité des machines ?

Chris Hickman: Most organizations have spent a lot of time and effort on streamlining their human identities. But now that they understand who people are, how they interact with each other, and how they securely authenticate, the time has come to start looking at doing that same approach with machines. 

Several initiatives, such as zero trust and moving to the cloud, are accelerating organizations’ need for machine identity management. Organizations are developing a stronger understanding of the security of the devices they are using, the communications between these devices, and the frontend and backend systems associated with them. They are realizing that machine identity can be effective, efficient, and agile from a lifecycle and incident management standpoint. 

Quels sont les changements qui modifient la façon dont les organisations gèrent l'identité des machines ?

Chris: Machine identity has come to the forefront because organizations are starting to consolidate the various teams that manage identity. For instance, PKI and X.509 certificates were traditionally the domain of a particular security group. But increasingly, we’re seeing the responsibilities for the issuance of the certificates falling under the identity management team. This shift to consolidation is driving the notion that identity is not just about security, and it’s causing companies to consider how they holistically manage identity within the business.

Quels sont les défis que les entreprises tentent de relever en ce qui concerne l'évolutivité de leur statut en matière de gestion des identités ?

Chris: The commonality we’re seeing is that there is very little understanding of where credentials and identities live within an enterprise, so they can’t figure out how big the problem is. Organizations are struggling to answer questions like:

• Combien de certificats ai-je dans mon entreprise ?
• How many SSH keys do I have?
• Où vivent les certificats ? 
• À quoi servent-ils ?
• D'où proviennent-ils ?
• Les certificats sont-ils conformes à la norme actuelle ? 
• Ont-ils un bon protocole de gestion du cycle de vie ?

The answers to these questions compound as an organization continues to scale and more certificates are used. According to Keyfactor’s annual State of Machine Identity Management report, 70% of organizations say the growth of keys and certificates has increased operational burden. Enterprises are turning to automation to help ease this burden so they can keep growing their business.

Quelles sont les mesures prises par Keyfactor pour résoudre les problèmes d'identité des machines des organisations ?

Chris: We start with a complete inventory of an organization to get visibility of the foundation of the machine identity problem. Then we look at assigning ownership, creating cross-functional groups, and defining who owns the credentials, because a single credential may have multiple owners. For example, there may be a credential that represents a web server, but on that web server is also an application. If the server goes down, then the application will be down. So, the ownership may be spread across multiple different teams. 

Ensuite, nous adaptons les politiques et les pratiques à la nouvelle structure pour que cette réflexion fasse partie de la culture enracinée. La dernière étape, mais non la moindre, est l'automatisation. Car une fois que l'automatisation est en place et qu'il n'est plus nécessaire de renouveler et de déployer manuellement les informations d'identification, l'organisation est en bien meilleure position pour évoluer et assurer la sécurité de l'entreprise.

Quelles sont les tendances que les entreprises devraient observer dès maintenant pour se préparer à l'avenir de l'identité des machines ?

Chris: There are several things afoot right now, particularly with the evolution of quantum computing and the maturing of cryptographic standards. Quantum computing is becoming a reality to the point where it could break existing cryptographic algorithms. This quantum threat is still evolving, but it will soon require organizations to change how machine identities are derived using cryptography. The potential risk is driving a change to cryptographic standards and protocols that organizations must start preparing for now. Otherwise, they will be at a disadvantage and open to significant security risks.

Vous avez d'autres questions sur l'identité des machines et ce qu'elle signifie pour votre organisation ?

More than one-thousand companies trust Keyfactor to issue, manage, and protect machine identities across their business. The Keyfactor platform is built to solve your present and future machine identity needs with integrated PKI, digital signing, and machine identity management.

Contactez-nous dès aujourd'hui pour en savoir plus.