Adequate management of machine identities crucial in digital transformation

The number of machine identities within organisations is growing by 42% year-on-year, shows research among 1,000 CIOs commissioned by Venafi. The industry is no exception. Kevin Bocek, Vice President, Security Strategy & Threat Intelligence at Venafi, explains why machine identities are highly relevant to the industry. Bocek also explains what makes managing machine identities very different from managing user identities.

Two types of actors operate within IT environments: human users and machines. Machines can be virtual, physical or a combination thereof. For instance, many manufacturing systems include not only hardware but also software. A machine identity defines the identity of a machine.

Machines come in all shapes and sizes. By no means all of them are systems that we traditionally refer to as machines. For instance, a machine can be a software application, regardless of whether it runs in an in-house IT environment or in the cloud. However, consider blockchain, a technology on which applications in industry are also increasingly based. Another example is a smart contract, the content of which is captured in a blockchain. A machine is basically anything that receives input and gives output.

The amount of machines within the average industrial company is huge. Thus, machines can also run on other machines. "For example, a production robot is a machine. A control software runs on this machine, which is also a machine. The robot runs applications on this control system, which in turn constitute its own machines," Kevin Bocek explains.

The average company now has around 250,000 machines, according to recent research by Venafi. Managing these identities is of great importance. "Regardless of where and how long a machine runs, an identity is crucial. For example, is the machine benign or malicious? In addition, which device performed which task with a view to accountability? Is the software used trusted and certified?" explains Bocek.

In addition, unlike humans, machines communicate exclusively publicly. "People can communicate privately among themselves - depending on the circumstances - to some extent. This is not the case with machines; all communication is via networks and is therefore by definition not private."

"Previously, many industrial companies had private networks, which were not connected to the internet. Increasingly, however, industrial parties are embracing the cloud, which does connect this private network to the internet. This connectivity offers significant advantages, but also carries risks. For instance, malicious parties can penetrate the network and intercept communications. "Using machine identities, we can identify and authenticate machines so that we can shield communications."

Managing machine identities is very different from managing human identities. For example, a new employee is assigned an access badge, a user account and a business e-mail address. Creating these is usually done manually and is a relatively slow process.

However, machine identities are highly dynamic. As such, the manual process we know from managing human identities is not suitable for managing machine identities. For example, recent research by Venafi shows that the number of machine identities held by companies is increasing on average by 42% year-on-year.

Not only is the quantity and growth enormous, the identities used are also highly dynamic. "Some identities exist for only a few seconds. In a day, as few as tens of thousands of machine identities can be newly created, while at the same time tens of thousands of others disappear. Machines can also create new ones independently," Bocek said. "This makes managing machine identities a lot more complex than managing user identities."

Failure or incorrect management of machine identities can lead to extensive cyber incidents. "One of the best-known examples of an attack where machine identities have been misused is Stuxnet," says Bocek. Stuxnet is malware that in 2010 struck Iranian ultracentrifuges used in Iran's nuclear programme. Stuxnet sabotaged these centrifuges, which were physically damaged as a result. "This malware was fully trusted worldwide, as its creators exploited stolen machine identities from Taiwanese companies."

Another example is Black Energy, malware that attacked industrial management systems (ICS) of the Ukrainian power grid. 230,000 households were affected by the blackout that followed on 23 December 2015. "This attack was so successful because the attackers had inserted a backdoor. Through this backdoor, they could authenticate themselves and thus gain access at any time, undetected," Bocek said. "The attackers penetrated via an SSH key. Applying a backdoor ensured that they retained access even if the cracked SSH key was changed."

"Many developments we are going to see in the coming years are driven by cloud-native technologies. In many cases, these technologies run on Kubernetes, a platform for orchestrating containerised workloads." These containers include software, where a combination of multiple containers builds an application. These containers function as off-the-shelf building blocks, which can run in any location. Think of an in-house IT environment or the cloud.

Every container that makes up a cloud-native application functions like a machine and has its own machine identity. This development is therefore a major contributor to the rapid growth in the number of machine identities used by companies. "Currently, the number of machine identities is already growing by 42% year-on-year. However, I expect this figure to be outdated by 2024 and the growth in the number of machine identities to have accelerated even further."

Would you like to find out more about Venafi’s research into machine identities? The company shares further insights in a blog post, or you can view the full research findings.

Author: Wouter Hoeffnagel
Source photo: Pixabay / Antonio Hernández