The Key to Strong Cloud Security
Download as PPTX, PDF0 likes1,136 views
The document discusses the challenges and solutions related to secrets management in cloud security, emphasizing the importance of privileged access, identity validation, and data encryption in the hybrid and multi-cloud environments. It highlights the role of Akeyless's secrets management platform, which aids enterprises in managing machine identities, secrets, keys, and certificates securely and effectively. Additionally, it addresses the risks associated with unprotected secrets and outlines best practices for ensuring secure access control and compliance.
The Key to Strong Cloud Security
- 1. Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Oded Hareven, CEO & Co-founder @ Akeyless Oded@akeyless.io {Ret. Captain, Israel Defence Forces, CyberSecurity Identity Management, PAM, Information Security Infrastructure Dev, Product, Ops} The Key to Strong Cloud Security
- 2. Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Akeyless DFC™ Virtual HSM Unique KMS Zero- Knowledge Technology, built for Hybrid era Unified SaaS IAM (1) Secrets Management (2) Secure Remote Access (3) Data Protection Akeyless Vault Platform Workload Identity Orchestration Serving market leaders enterprises Pharma, Software, Adtech, Online, E-commerce, Gaming Globally Available SaaS
- 3. 3 Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Challenges of the DevOps and Cloud Era • Ephemeral resources + Automation + IaC • Multiple environments • Hybrid Authentication • Perimeter-less world = data is everywhere • Root-of-trust in a non-trusted distributed architecture • Privileged Access (Remote, WFH, COVID-19)
- 4. 4 Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Admin Password PKI Certificate Application API-Key SQL Credentials AES Encryption RSA Signing Key SSH Key In short, it’s an IAM Chaos. Credentials SSH Certificate Trends that encourage the Massive use of Secrets 1. Containerization 2. Hybrid & multi-cloud 3. DevOps, CI/CD, Automation 4. Zero-Trust
- 5. 5 Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Data encryption Step #1: Data Protection & Access Control • Access Control • Control who can access the data? • How to validate her identity? • Data Encryption • Control who can access the encryption key? • How to validate his identity? Data Access Control
- 6. 6 Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Step #2: Identity Validation • Requires Authentication • Human • Machine • Using something that only the human/machine has • Secret = {password, credentials, api-key, certificate, ssh-key} • If you can’t keep a Secret - you can’t protect your Data... Password DB password DB User Application
- 7. 7 Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Step #3: Privileged Access • Who’s controlling my workloads? • Software Developers, DevOps Engineers, IT Architects • External vendors • Can they impersonate? • Admin can do everything... • PAM • Regulation and compliance • Session recording - Control human admin access • Secrets Repository • Default admin passwords rotation • Automation = Machines’ Privileged Access Password DB password DB User Application Admin OS Admin OS Admin Password Password
- 8. 8 Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Step #4: Root-of-Trust • Using an Encryption key to encrypt secrets & data +Using signing key to sign TLS/SSH Certificates = identities • Where to place the key? • Configuration - bad practice • Local store - not secured enough • KMS - good start • HSM - considered to be most secure • Secret-zero: accessing the key requires a secret? The chicken and the egg... Hardware Security Module
- 9. Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Secrets Sprawl: Clear-text, unprotected Source Code DevOps Scripts Configuration Files x myScript { // App.Config DB password = “T0pSecr3t” API_Key_AWS = “Cl3aRt3xt$!” } x //myconfig < // App.Config Access_Token = “T0pSecr3t” API_Key_GCP = “Cl3aRt3xt$!” /> x Void myCode( ) { // App.Config Encryption_Key = “aKey43!t” API_Key_Azure = “Cl3a3xt$!” } Secrets are used also within workload management platforms
- 10. Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 10 Report:"Managing Machine Identities, Secrets, Keys and Certificates" Published: 24 August 2020 Analyst: Erik Wahlstrom Source: Akeyless is mentioned in this Gartner report as a key player in the Secrets Management realm, p16. under “secrets management solutions”
- 11. Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Secrets Management Fetch credentials, certificates and keys from any client - platform, script or application ***** ***** ***** API / SDK / CLI / Plugins Customer Application Customer Database 3rd-party Service API Password = “Pass12#” Applications Encrypted Secrets Store Human DevOps, IT, Developers Secrets Management
- 12. 12 Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Multi-channel Integration and Authentication Authentication via LDAP SAML OpenID Direct channels Platforms Plugins (examples) Machine authentication Human authentication
- 13. 13 Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Availability and Scalability What happens when all your workloads and employees are using a centralized Secrets Management system? • Ensure Service Continuity • Multi-region / hybrid / multi cloud • Disaster Recovery, Replication, Backup, Monitoring • Complex IT project • Consider: Self-deployment vs. SaaS
- 14. 14 Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Data encryption Yet this is not all…. Data Access Control
- 15. 15 Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Just-in-time temporary credentials +SSH, RDP, Kubectl, SQL, Web applications and more... Isolated Session +Session Recording & transcript Zero-Trust Privileged Access / PAM 2.0 How to provide a Secure Workload Access? External Access Employee/Vendor Internal Resources Linux Servers Windows servers Databases Web applications Private Network Public Network SSH Tunnel Identity Providers Via LDAP, SAML, OpenID Customer Side *TrustScore Ready internal Access Employee
- 16. Proprietary and Confidential, Akeyless Security Ltd ©️ 2021 Thank you. Further questions & thoughts you’d like to share? Mostly invited to drop an email to Oded@akeyless.io