Posted by Alon Gvili
October 18, 2024
Managing usernames and passwords has become an increasing challenge in today’s highly automated, multi-cloud, and microservice environments. From a security perspective, the greatest challenge is long-lived credentials that can be compromised.
This is where Akeyless and its secretless approach come in, promising a robust and scalable solution for Secure Remote Access (SRA) – also known as Next Gen PAM.
Let’s consider the differences in human and machine identity management
Human identity management is what most people are more familiar with: the securitization of employee, contractor, and administrator credentials, which is classically done with a combination of passwords and MFA. However, many organizations have recently adopted passwordless authentication with SSO or biometric methods. These do not involve any of the above-mentioned risks of password theft or password reuse. This move to passwordless methods of logging in significantly enhances security on the human user side.
Machine identity management is a little different. Machine identities involve APIs, microservices, and other non-human entities that connect to systems. These tend to authenticate by using static API keys, certificates, or tokens, which can pose serious security risks if compromised. The management of such secrets, mostly in dynamic environments like Kubernetes, remains one of the biggest challenges.
Akeyless addresses this through secretless authentication that eliminates the use of static secrets and replaces them with dynamic, shortlived credentials generated on demand.
Secretless and Passwordless Access: Key Benefits
Akeyless provides flexible, secure solutions for secret-based and secretless access. Embracing passwordless authentication for humans and secretless methods for machines empowers Akeyless to help drive security forward in many real-life use cases such as:
Connecting to Remote Databases
When connecting to PostgreSQL or MySQL databases, securing access for both human and machine identities is critical.
- For humans: Akeyless supports SSO and MFA integration to help administrators and employees log in safely to the cloud database with no passwords involved. By enabling passwordless authentication, we avoid the use of static credentials minimizing the risk of password-related breaches.
- For machines, Akeyless can provide ephemeral API tokens to services or apps on the back-end that need to reach the database. Without the long-lived credentials, these are the JIT tokens generated dynamically to provide the secretless way of handling machine authentication.
Accessing Linux Servers
For SSH access to Linux servers, Akeyless enhances security by providing passwordless methods, reducing dependency on static SSH keys as follows:
For human administrators: Akeyless generates short-lived SSH certificates whereby temporary credentials will be provided that expire at the end of each session, and no long-lived secrets are stored.
For automated processes: whether the continuous deployment of code or management of server configuration, machine identities can authenticate via secretless methods using JIT tokens. These tokens grant access to servers only when needed and keep the minimal risk for exposed secrets.
Securing Kubernetes (K8s) Clusters
In Kubernetes environments, Static secrets cannot manage machine identities because of the rapid creation and destruction of containers.
For microservices: Akeyless provides dynamically generated, short-lived tokens for authenticating microservices and other components within the cluster. This form of secretless authentication reduces the overhead of managing static credentials.
For humans: DevOps teams managing Kubernetes clusters may enable the K8s authentication mode. It utilizes K8s JSON Web Tokens (JWT) to authenticate the K8s application, such as a pod. This K8s JWT, at all times during the process flow, is never shared with Akeyless or any other third party, except with the Akeyless Gateway only.
Recent high-profile cybersecurity incidents can help us understand how the approaches mentioned above could have made a difference.
Colonial Pipeline Ransomware Attack
This incident happened in 2021, where the attackers exploited a compromised VPN credential and gained access to critical systems without any MFA. With SRA, Akeyless would have enforced MFA and passwordless authentication for remote access, ensuring that no compromised passwords could have been used to access the system without additional authentication factors. Akeyless could also enable RBAC limiting user permissions and securing privileged remote access with short-lived tokens and encrypted communications.
Okta Breach
In the breach that happened in 2022, cybersecurity attackers took advantage of excessive administrative permissions given to users in order to access sensitive information.
By enforcing MFA and passwordless authentication upon remote connection, SRA users would have ensured that even if their credentials were compromised, attackers wouldn’t be able to leverage them without additional authentication layers. For machine identities, JIT tokens could have replaced long-lived access credentials, reducing the potential for widespread compromise.
Akeyless as a Unified Platform
What will make Akeyless different is that it’s a holistic platform offering so much more than just Secure Remote Access.
It includes:
- Secrets Management: Centralized storage and management of credentials.
- Certificate Lifecycle Management: Automate the issuance, renewal, and revocation of certificates for both humans and machines.
- Password Management: A secure vault to store and share your passwords.
- Data Protection: Encrypt data at rest and in flight.
- Universal Secrets Connector: It seamlessly integrates the multicloud environment, ensuring that secrets remain secure throughout hybrid infrastructures.
Integration with other solutions
Akeyless integrates the project SPIFFE– Secure Production Identity Framework for Everyone-to provide secretless management to Workload Identities. Using SPIFFE, the workload will have limited handling of secrets. Encryption keys, certificates, and secrets still require secure management underneath it all. In this respect, Akeyless’ secret management system will play a vital role in managing the lifecycle of those underlying security elements and make the SPIFFE framework scalable and secure.
Conclusion: A New Era of Identity Management
The Akeyless Secretless approach, together with passwordless authentication, equips organizations with a comprehensive solution for secure and scalable remote access. By eliminating long-lived secrets, coupled with dynamic, short-lived credentials, Akeyless significantly reduces the risks involved in managing both human and machine identities. Whether remote databases, Linux servers, or Kubernetes clusters, Akeyless supports organizations in increasing their security while keeping things simple regarding identity management.
Akeyless offers a unified platform that is able to secure an infrastructure from end to end.
