TNS
VOXPOP
Do You Resent AI?
If you’re a developer, do you resent generative AI’s ability to write code?
Yes, because I spent a lot of time learning how to code.
0%
Yes, because I fear that employers will replace me and/or my peers with it.
0%
Yes, because too much investment is going to AI at the expense of other needs.
0%
No, because it makes too many programming mistakes.
0%
No, because it can’t replace what I do.
0%
No, because it is a tool that will help me be more productive.
0%
No, I am a highly evolved being and resent nothing.
0%
I don’t think much about AI.
0%
DevOps / Microservices / Security

Taking a ‘Machine-First’ Approach to Identity Management

Uncovering what each identity is accessing and why, startup Token Security provides essential data to understand microservices vulnerabilities.
May 13th, 2024 11:47am by
Featued image for: Taking a ‘Machine-First’ Approach to Identity Management

The breach of Microsoft’s Exchange Online email accounts illustrates the need for a new approach to identity management in the microservices era, according to Ido Shlomo, cofounder and CTO at Token Security.

In that attack, hackers used residential proxies and “password spraying” brute-force attacks to target a few accounts, among them a legacy, non-production test tenant account with access to an OAuth application with elevated access to Microsoft‘s corporate environment.

All too often, organizations simply aren’t aware of all the identities and permissions that allow access to systems and sensitive data. Rather than trying to lock down the permissions granted each person in an organization, Tel Aviv-based Token Security takes an opposite tack, what it calls a “machine-first” approach — uncovering what each identity to a machine or service is accessing and why.

“IAM (identity and access management) technology that used to be Active Directory is now fragmented into a lot of different technologies,” said Itamar Apelblat, Token Security cofounder and CEO. “So you have now a lot of identities, a lot of users in different technologies. And security teams have this pain of even understanding what are all those identities that they need to protect.”

Microservices Complexity

With microservices, machine identities are proliferating at an alarming rate. Cyberark has reported that the ratio of machine identities to humans in organizations is 45 to 1. At the same time, 87% of respondents in its survey said they store secrets in multiple places across DevOps environments.

Curity’s Michal Trojanowski previously wrote about the complex mesh of services comprising an API, adding that securing them is not just about authenticating the user.

“A service that receives a request should validate the origin of the request. It should verify the external application that originally sent the request and use an allowlist of callers. The service should also be able to verify the direct internal caller, such as an API gateway or another service that has forwarded the request, through mechanisms that can limit unnecessary communication between parties,” he wrote.

And AI is only adding to the complex web of identities.

“Today, machine-to-machine communication is the norm … and AI creates new services with new identities, connections and permissions even with no humans in the loop,” noted Rona Segev, a managing partner at TLV Partners, which backed Token Security’s recent $7 million seed round.

Data Key to Security

Using agentless scanning of the identity repositories engineers are using and log analysis, the company first maps all the non-human identities throughout the infrastructure — Kubernetes, databases, applications, workloads, and servers. It creates what it calls attribution— a strong context of which workloads and which humans use each identity, including an understanding its dependencies.

Mapping ownership of the various identities also is key.

“Think about organizations that have thousands of developers. Security teams sometimes find issues but don’t know how to solve them because they don’t know who to talk with,” Apelblat said.

It also can cluster identities, credentials and entitlements for different teams, such as DevOps, data engineers, site reliability engineering (SREs) and more.

And it does its work in the background, integrating with event data from the logs without disrupting how workloads and cloud identities interact or slowing down development processes.

“Organizations don’t want to change the velocity of the software development life cycle. So they don’t want the security team to now have to approve every new identity or resource that is being created in the cloud. It can get complicated,” Shlomo said.

Token can detect when a new environment, credential or permission is created as it happens.

It then prioritizes those identities based on their potential impact and likelihood of being compromised. It ensures they all operate under the principle of least privilege. Automated mitigation can be implemented for vulnerable non-human identities as well as rotation procedures for keys and other credentials. It also offers continuous monitoring with alerting to identify suspicious behavior.

“If we talk about what the solution really gives our end customers, is really eliminating identity risk in a very high capacity — being able to take security teams all the way from not really knowing what their identities are, not having a centralized place that they could discover everything and understand all of the entitlements, identities and credentials that they have … taking them to a place where they eliminate the highest value risks and reduce the attack surface as much as possible,” Shlomo said.

Group Created with Sketch.
TNS owner Insight Partners is an investor in: Kubernetes.
TNS DAILY NEWSLETTER Receive a free roundup of the most recent TNS articles in your inbox each day.